12 CFR §232.1

1. (a)Scope. This part applies to creditors, as defined in paragraph (c)(3) of this section, except for creditors that are subject to §§ 41.30, 222.30, 334.30, 571.30, or 717.30.
2. (b)In general. A creditor may not obtain or use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit, except as provided in this section.
3. (c)Definitions.
   1. (1)Consumer means an individual.
   2. (2)Credit has the same meaning as in section 702 of the Equal Credit Opportunity Act, 15 U.S.C. 1691a.
   3. (3)Creditor has the same meaning as in section 702 of the Equal Credit Opportunity Act, 15 U.S.C. 1691a.
   4. (4)Eligibility, or continued eligibility, for credit means the consumer's qualification or fitness to receive, or continue to receive, credit, including the terms on which credit is offered. The term does not include:
      1. (i)Any determination of the consumer's qualification or fitness for employment, insurance (other than a credit insurance product), or other non-credit products or services;
      2. (ii)Authorizing, processing, or documenting a payment or transaction on behalf of the consumer in a manner that does not involve a determination of the consumer's eligibility, or continued eligibility, for credit; or
      3. (iii)Maintaining or servicing the consumer's account in a manner that does not involve a determination of the consumer's eligibility, or continued eligibility, for credit.
   5. (5)Medical information means:
      1. (i)Information or data, whether oral or recorded, in any form or medium, created by or derived from a health care provider or the consumer, that relates to—
         1. (A)The past, present, or future physical, mental, or behavioral health or condition of an individual;
         2. (B)The provision of health care to an individual; or
         3. (C)The payment for the provision of health care to an individual.
      2. (ii)The term does not include:
         1. (A)The age or gender of a consumer;
         2. (B)Demographic information about the consumer, including a consumer's residence address or e-mail address;
         3. (C)Any other information about a consumer that does not relate to the physical, mental, or behavioral health or condition of a consumer, including the existence or value of any insurance policy; or
         4. (D)Information that does not identify a specific consumer.
   6. (6)Person means any individual, partnership, corporation, trust, estate cooperative, association, government or governmental subdivision or agency, or other entity.