FACTA Medical Chicago Regional Training Conference Indianapolis, Indiana June 14, 2006 David Lafleur, Policy Analyst-Compliance Federal Deposit Insurance Corporation Washington, DC

Specific Exceptions Power of attorney based on a medical event Compliance w/ Federal, State, or Local Laws Special Purpose Credit Programs for medical conditions Fraud prevention or detection Verify purpose and/or use of proceeds for a medically- related loan Accommodations at the specific request of consumer (requires documentation) Forbearance practices or programs Activation / trigger of debt suspension agreements Eligibility / trigger of credit insurance for a medical reason

Limits on Re-disclosure of Medical Information Prohibition on re-disclosing medical information received from a consumer reporting agency or an affiliate except as necessary to carry out purpose for which is was obtained, or otherwise permitted by statute, regulation, or order

Sharing Medical Information with Affiliates Bank will become a consumer reporting agency (subject to FCRA compliance burden) if medical information is shared with an affiliate. Regulation contains exceptions.

Affiliate Sharing - Exceptions In connection w/ business of insurance or annuities Any purpose permitted without authorization under HIPAA Any purpose referred in Section 1179 of HIPAA Any purpose described in Sections.14 or.15 of the GLBA Privacy Regulations (FDIC Part 332) Consistent with the Financial Information Exception or other specific exceptions in FDIC Part 334 By order of the FDIC

Examination Procedures RD memo will be issued with procedures. Procedures amend overall FCRA procedures last issued on Feb 22, 2006 (RD memo transmittal number ). Focus on banks’ policies and procedures, transaction testing when necessary.