By Sean Marciniak Congress Moves to Limit Access to Information It isn't supposed to be there, but medical data can show up in your credit report. It means your banker, after seeing that credit-card payment you made to the local psychiatrist, might decide he would rather not give you a loan. Congress is attempting to come to the rescue. Last month, the House Committee on Financial Services resoundingly approved a bill that would keep sensitive medical information out of credit reports. The Fair and Accurate Credit Transactions Act, slated for a vote in the full House this fall, would prohibit affiliates of a corporation from sharing medical information without a customer's consent. The act also seeks to require the use of some type of code for any health information that does manage to slip into a credit report. The medical-privacy issue is one of many that have arisen as part of a larger debate in Congress over renewing sections of the Fair Credit Report Reporting Act, which sets national standards on the content of credit reports and regulates how companies can buy, sell and share that information. Certain sections are set to expire Jan. 1. In addition to the medical-privacy section of the bill, lawmakers are seeking to add provisions intended to curb identity theft and credit-reporting errors. It's unclear how many creditors, if any, evaluate a consumer's risk on the basis of health. In 1993, a government report referred to a case of a banker, operating out of the Midwest, who used medical data to determine which of his customers suffered from disease, then called due the mortgages of those customers who had cancer. However, the government's source of this anecdote, C. Peter Waegemann, executive director of the Boston-based Medical Records Institute, acknowledged recently that he heard the story from a source he trusts but was never able to verify it. "I tried many times for many organizations to retrace it, but I never found the banker," he said. Still, the potential exists for databases to flow into one another. "I think it's part of a broader concern of access to information and who controls information," said Raphael Bostic, an economist at the University of Southern California. "So I think in that context it makes sense that people should be mindful of this issue." As a practical matter, however, Mr. Bostic said that due to limited time and resources, most bankers make credit decisions with a quick look at a credit score. Others, however, see the potential for abuse and don't like it. "Fifteen years ago, it was virtually unheard of for insurers to use consumer credit histories to determine insurance premiums or whether to cancel or renew an insurance policy," said Joy Pritts, an assistant research professor at Georgetown University, during a congressional hearing in June. "Now, it is becoming increasingly commonplace. Who can say whether medical information for credit decisions will develop along the same lines?" Numerous studies on credit, including one by the Federal Reserve, have found that a substantial amount of health data could be inferred from entries on a credit report. Specifically, financial institutions and other creditors list the names of medical providers to whom their customers owed money. Credit experts said a banker could infer a customer had a particular illness if the credit report showed the customer had paid money to a certain cancer center, AIDS clinic, neonatal clinic, psychiatrist or alcohol abuse center. Another way financial institutions come across medical data stems from the loosely regulated data-sharing that goes on between affiliates of the same company. Whereas credit bureaus and creditors must exchange data under strict rules that largely prohibit the trafficking of medical information, affiliates can share records of their own transactions and experiences with customers without restriction. That can include medical information. A life insurer, for example, which asks for medical information in its application, legally could share what it discovers with an affiliated bank. A credit-card issuer with a complete history of a customer's payments could show it to an affiliated mortgage lender. Some big financial institutions have their own rules against this, however. For example, both Citigroup Inc. and Bank of America Corp., which each have several units that deal with consumers, have policies that allow affiliates to share medical information only when it is used to process transactions and maintain accounts. They say consumers can "opt out" of the sharing agreement. "We use it strictly to process a specific transaction, such as an insurance policy approval," said Bank of America spokeswoman Eloise Hale. The bill now under consideration in the House expressly prohibits bankers from using medical information to make credit decisions and would subject affiliates to the same standards as credit bureaus when it comes to sharing information. In addition, every information exchange for credit purposes would require a customer's written consent. The bill, however, has one big hole, some critics and even some supporters concede. It lurks in the definition of "medical information." Susan Henrichsen, a supervising deputy attorney general in California, said the Fair Credit Reporting Act narrowly defines medical information as records obtained from sources like doctors and hospitals. That means any information originating from a life insurer wouldn't be subject to any new rules about sharing medical information with nonaffiliates. Under the new bill, a life insurer would still need only disclose to consumers that it might share information with a nonaffiliate and then offer them an opportunity to opt out, a clause that usually is buried in fine print, experts said. "There's just not good coverage here, not the kind you would want if you care about medical-information privacy," Ms. Henrichsen said. Rep. Barney Frank (D., Mass.), ranking member in the Committee on Financial Services, said the issue could be reviewed on the House floor.
August 6, 2003