PROTECTION OF MEDICAL INFORMATION IN THE FINANCIAL SYSTEM.

SEC. 411. PROTECTION OF MEDICAL INFORMATION IN THE FINANCIAL SYSTEM.(a) In General.—Section 604(g) of the Fair Credit Reporting Act (15 U.S.C. 1681b(g)) is amended to read as follows:117 STAT. 2000 “(g) Protection of Medical Information.—“(1) Limitation on consumer reporting agencies.—A consumer reporting agency shall not furnish for employment purposes, or in connection with a credit or insurance transaction, a consumer report that contains medical information about a consumer, unless—“(A) if furnished in connection with an insurance transaction, the consumer affirmatively consents to the furnishing of the report;“(B) if furnished for employment purposes or in connection with a credit transaction—“(i) the information to be furnished is relevant to process or effect the employment or credit transaction; and“(ii) the consumer provides specific written consent for the furnishing of the report that describes in clear and conspicuous language the use for which the information will be furnished; or“(C) the information to be furnished pertains solely to transactions, accounts, or balances relating to debts arising from the receipt of medical services, products, or devises, where such information, other than account status or amounts, is restricted or reported using codes that do not identify, or do not provide information sufficient to infer, the specific provider or the nature of such services, products, or devices, as provided in section 605(a)(6).“(2) Limitation on creditors.—Except as permitted pursuant to paragraph (3)(C) or regulations prescribed under paragraph (5)(A), a creditor shall not obtain or use medical information pertaining to a consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit.“(3) Actions authorized by federal law, insurance activities and regulatory determinations.—Section 603(d)(3) shall not be construed so as to treat information or any communication of information as a consumer report if the information or communication is disclosed—“(A) in connection with the business of insurance or annuities, including the activities described in section 18B of the model Privacy of Consumer Financial and Health Information Regulation issued by the National Association of Insurance Commissioners (as in effect on January 1, 2003);“(B) for any purpose permitted without authorization under the Standards for Individually Identifiable Health Information promulgated by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996, or referred to under section 1179 of such Act, or described in section 502(e) of Public Law 106–102; or“(C) as otherwise determined to be necessary and appropriate, by regulation or order and subject to paragraph (6), by the Commission, any Federal banking agency or the National Credit Union Administration (with respect to any financial institution subject to the jurisdiction of such agency or Administration under paragraph (1), (2), or (3) of section 621(b), or the applicable State insurance 117 STAT. 2001 authority (with respect to any person engaged in providing insurance or annuities).“(4) Limitation on redisclosure of medical information.—Any person that receives medical information pursuant to paragraph (1) or (3) shall not disclose such information to any other person, except as necessary to carry out the purpose for which the information was initially disclosed, or as otherwise permitted by statute, regulation, or order. “(5) Regulations and effective date for paragraph (2).—“(A) Regulations required.—Each Federal banking agency and the National Credit Union Administration shall, subject to paragraph (6) and after notice and opportunity for comment, prescribe regulations that permit transactions under paragraph (2) that are determined to be necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (and which shall include permitting actions necessary for administrative verification purposes), consistent with the intent of paragraph (2) to restrict the use of medical information for inappropriate purposes. “(B) Final regulations required.—The Federal banking agencies and the National Credit Union Administration shall issue the regulations required under subparagraph (A) in final form before the end of the 6-month period beginning on the date of enactment of the Fair and Accurate Credit Transactions Act of 2003.“(6) Coordination with other laws.—No provision of this subsection shall be construed as altering, affecting, or superseding the applicability of any other provision of Federal law relating to medical confidentiality.”.(b) Restriction on Sharing of Medical Information.—Section 603(d) of the Fair Credit Reporting Act (15 U.S.C. 1681a(d)) is amended—(1) in paragraph (2), by striking “The term” and inserting “Except as provided in paragraph (3), the term”; and(2) by adding at the end the following new paragraph:“(3) Restriction on sharing of medical information.—Except for information or any communication of information disclosed as provided in section 604(g)(3), the exclusions in paragraph (2) shall not apply with respect to information disclosed to any person related by common ownership or affiliated by corporate control, if the information is—“(A) medical information;“(B) an individualized list or description based on the payment transactions of the consumer for medical products or services; or“(C) an aggregate list of identified consumers based on payment transactions for medical products or services.”.(c) Definition.—Section 603(i) of the Fair Credit Reporting Act (15 U.S.C. 1681a(i)) is amended to read as follows:“(i) Medical Information.—The term ‘medical information’—“(1) means information or data, whether oral or recorded, in any form or medium, created by or derived from a health care provider or the consumer, that relates to—“(A) the past, present, or future physical, mental, or behavioral health or condition of an individual;117 STAT. 2002“(B) the provision of health care to an individual; or“(C) the payment for the provision of health care to an individual.“(2) does not include the age or gender of a consumer, demographic information about the consumer, including a consumer’s residence address or e-mail address, or any other information about a consumer that does not relate to the physical, mental, or behavioral health or condition of a consumer, including the existence or value of any insurance policy.”.(d) Effective Dates.—This section shall take effect at the end of the 180-day period beginning on the date of enactment of this Act, except that paragraph (2) of section 604(g) of the Fair Credit Reporting Act (as amended by subsection (a) of this section) shall take effect on the later of—(1) the end of the 90-day period beginning on the date on which the regulations required under paragraph (5)(B) of such section 604(g) are issued in final form; or(2) the date specified in the regulations referred to in paragraph (1).