(a) In generalSubject to subsection (c), any consumer reporting agency may furnish a consumer report under the following circumstances and no other:(1) In response to the order of a court having jurisdiction to issue such an order, a subpoena issued in connection with proceedings before a Federal grand jury, or a subpoena issued in accordance with section 5318 of title 31 or section 3486 of title 18.
(2) In accordance with the written instructions of the consumer to whom it relates.
(3) To a person which it has reason to believe—(A) intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer; or
(B) intends to use the information for employment purposes; or
(C) intends to use the information in connection with the underwriting of insurance involving the consumer; or
(D) intends to use the information in connection with a determination of the consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status; or
(E) intends to use the information, as a potential investor or servicer, or current insurer, in connection with a valuation of, or an assessment of the credit or prepayment risks associated with, an existing credit obligation; or
(F) otherwise has a legitimate business need for the information—(i) in connection with a business transaction that is initiated by the consumer; or
(ii) to review an account to determine whether the consumer continues to meet the terms of the account.
(G) executive departments and agencies in connection with the issuance of government-sponsored individually-billed travel charge cards.
(4) In response to a request by the head of a State or local child support enforcement agency (or a State or local government official authorized by the head of such an agency), if the person making the request certifies to the consumer reporting agency that—(A) the consumer report is needed for the purpose of establishing an individual’s capacity to make child support payments, determining the appropriate level of such payments, or enforcing a child support order, award, agreement, or judgment;
(B) the parentage of the consumer for the child to which the obligation relates has been established or acknowledged by the consumer in accordance with State laws under which the obligation arises (if required by those laws); and
(C) the consumer report will be kept confidential, will be used solely for a purpose described in subparagraph (A), and will not be used in connection with any other civil, administrative, or criminal proceeding, or for any other purpose.
(5) To an agency administering a State plan under section 654 of title 42 for use to set an initial or modified child support award.
(6) To the Federal Deposit Insurance Corporation or the National Credit Union Administration as part of its preparation for its appointment or as part of its exercise of powers, as conservator, receiver, or liquidating agent for an insured depository institution or insured credit union under the Federal Deposit Insurance Act [12 U.S.C. 1811 et seq.] or the Federal Credit Union Act [12 U.S.C. 1751 et seq.], or other applicable Federal or State law, or in connection with the resolution or liquidation of a failed or failing insured depository institution or insured credit union, as applicable. (g) Protection of medical information(1) Limitation on consumer reporting agenciesA consumer reporting agency shall not furnish for employment purposes, or in connection with a credit or insurance transaction, a consumer report that contains medical information (other than medical contact information treated in the manner required under section 1681c(a)(6) of this title) about a consumer, unless—(A) if furnished in connection with an insurance transaction, the consumer affirmatively consents to the furnishing of the report;
(B) if furnished for employment purposes or in connection with a credit transaction—(i) the information to be furnished is relevant to process or effect the employment or credit transaction; and
(ii) the consumer provides specific written consent for the furnishing of the report that describes in clear and conspicuous language the use for which the information will be furnished; or
(C) the information to be furnished pertains solely to transactions, accounts, or balances relating to debts arising from the receipt of medical services, products, or devises, where such information, other than account status or amounts, is restricted or reported using codes that do not identify, or do not provide information sufficient to infer, the specific provider or the nature of such services, products, or devices, as provided in section 1681c(a)(6) of this title.
(2) Limitation on creditorsExcept as permitted pursuant to paragraph (3)(C) or regulations prescribed under paragraph (5)(A), a creditor shall not obtain or use medical information (other than medical information treated in the manner required under section 1681c(a)(6) of this title) pertaining to a consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit.
(3) Actions authorized by Federal law, insurance activities and regulatory determinationsSection 1681a(d)(3) of this title shall not be construed so as to treat information or any communication of information as a consumer report if the information or communication is disclosed—(A) in connection with the business of insurance or annuities, including the activities described in section 18B of the model Privacy of Consumer Financial and Health Information Regulation issued by the National Association of Insurance Commissioners (as in effect on January 1, 2003);
(B) for any purpose permitted without authorization under the Standards for Individually Identifiable Health Information promulgated by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996, or referred to under section 1179 of such Act,1 or described in section 6802(e) of this title; or
(C) as otherwise determined to be necessary and appropriate, by regulation or order, by the Bureau or the applicable State insurance authority (with respect to any person engaged in providing insurance or annuities).
(4) Limitation on redisclosure of medical informationAny person that receives medical information pursuant to paragraph (1) or (3) shall not disclose such information to any other person, except as necessary to carry out the purpose for which the information was initially disclosed, or as otherwise permitted by statute, regulation, or order.
(5) Regulations and effective date for paragraph (2)(A)22 So in original. No subpar. (B) has been enacted.
Regulations requiredThe Bureau may, after notice and opportunity for comment, prescribe regulations that permit transactions under paragraph (2) that are determined to be necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (and which shall include permitting actions necessary for administrative verification purposes), consistent with the intent of paragraph (2) to restrict the use of medical information for inappropriate purposes.
(6) Coordination with other lawsNo provision of this subsection shall be construed as altering, affecting, or superseding the applicability of any other provision of Federal law relating to medical confidentiality.
(Pub. L. 90–321, title VI, § 604, as added Pub. L. 91–508, title VI, § 601, Oct. 26, 1970, 84 Stat. 1129; amended Pub. L. 101–73, title IX, § 964(c), Aug. 9, 1989, 103 Stat. 506; Pub. L. 104–193, title III, § 352, Aug. 22, 1996, 110 Stat. 2240; Pub. L. 104–208, div. A, title II, §§ 2403, 2404(a), (b), 2405, Sept. 30, 1996, 110 Stat. 3009–430, 3009–431, 3009–433, 3009–434; Pub. L. 105–107, title III, § 311(a), Nov. 20, 1997, 111 Stat. 2255; Pub. L. 105–347, §§ 2, 3, 6(4), Nov. 2, 1998, 112 Stat. 3208, 3210, 3211; Pub. L. 107–306, title VIII, § 811(b)(8)(A), Nov. 27, 2002, 116 Stat. 2426; Pub. L. 108–159, title II, § 213(c), title IV, §§ 411(a), 412(f), title VIII, § 811(b), Dec. 4, 2003, 117 Stat. 1979, 1999, 2003, 2011; Pub. L. 108–177, title III, § 361(j), Dec. 13, 2003, 117 Stat. 2625; Pub. L. 109–351, title VII, § 719, Oct. 13, 2006, 120 Stat. 1998; Pub. L. 110–161, div. D, title VII, § 743, Dec. 26, 2007, 121 Stat. 2033; Pub. L. 111–24, title III, § 302, May 22, 2009, 123 Stat. 1748; Pub. L. 111–203, title X, § 1088(a)(2)(A), (4), July 21, 2010, 124 Stat. 2087; Pub. L. 114–94, div. G, title LXXX, § 80001, Dec. 4, 2015, 129 Stat. 1792; Pub. L. 116–283, div. F, title LXIII, § 6308(b), Jan. 1, 2021, 134 Stat. 4594.)