This is basically an advertisement and you have the opportunity to control the content. The ad should be compliant with all regulatory requirements. You could maintain that you were unaware of the ad, etc. but that wouldn't be "doing it right".
If you really want to cooperate on this cobranding and referral program a link on their site to your site, where all this advertisement would be, would allow you the controls necessary to do it right. So at the medical site, you click for financing info and boom, you are transported to a special offering page on your bank's site.
I don't know that it will apply here, but you may have to look at your scenario and determine who is collecting what data and if HIPPA applies anywhere.
_________________________
AndyZ CRCM
My opinions are not necessarily my employers.
R+R-R=R+R
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell