‘‘(A) for a purpose described in paragraph
(1), (2), (3), (5), (7), or (8) of section 502(e);
‘‘(B) in order to facilitate customer service,
such as maintenance and operation of consoli-
dated customer call centers or the use of con-
solidated customer account statements; or
‘‘(C) to the institution’s attorneys, ac-
countants, and auditors.
‘‘(5) LIMITS ON REDISCLOSURE AND REUSE OF
INFORMATION.—
‘‘(A) IN GENERAL.—Except as provided in
subparagraph (B), an affiliate or a nonaffiliated
third party that receives individually identifiable
health information from a financial institution
under this section shall not disclose such infor-
mation to any other person, unless such disclo-
sure would be lawful if made directly to such
other person by the financial institution.
‘‘(B) DISCLOSURE
UNDER
AN
EXCEP-
TION.—Notwithstanding subparagraph (A), any
person that receives individually identifiable
health information from a financial institution
in accordance with one of the exceptions in
paragraph (4) may use or disclose such infor-
mation only—
‘‘(i) as permitted under that excep-
tion; or
‘‘(ii) under another exception in such
paragraph to carry out the purpose for
which the information was disclosed by the
financial institution.
‘‘(6) CONSTRUCTION.—Except as provided in
paragraph (4)(A), this section applies in lieu of sub-
sections (b), (c), and (e) of section 502 to a disclo-
sure by a financial institution of individually identifi-
able health information.
‘‘(b) RULES FOR RECEIPT AND USE.—
‘‘(1) IN GENERAL.—In deciding whether, or on
what terms, to offer, provide, or continue to provide
a loan or credit to a consumer, a financial institu-
tion shall not request to receive individually identifi-
able health information about the consumer from an
affiliate or nonaffiliated third party, or use, evaluate,
or otherwise consider any such information, unless
the financial institution—
‘‘(A) has clearly and conspicuously re-
quested in writing, in electronic form, or in an-
other form permitted by the regulations imple-
menting this subtitle, that the consumer affirm-
atively consent to such receipt and use; and
‘‘(B) has obtained from the consumer such
affirmative consent and such consent has not
been withdrawn.
‘‘(2) 
RESTRAINT
ON
INFORMATION
RE-
QUESTS.—In deciding whether, or on what terms, to
offer, provide, or continue to provide a loan or credit
to a consumer, a financial institution shall not re-
quest the consent described in paragraph (1)(A) to
receive individually identifiable health information
available from an affiliate, if the financial institution
would not otherwise normally receive the same or
substantially similar information from a non-
affiliated third party if that third party were the
only person able to provide the information.
‘‘(c) CONSUMER RIGHTS TO ACCESS AND CORRECT
INFORMATION.—
‘‘(1) ACCESS.—
‘‘(A) IN GENERAL.—Upon the request of a
consumer, a financial institution shall make
available to the consumer individually identifi-
able health information about the consumer
that is within the possession of the financial in-
stitution.
‘‘(B) EXCEPTIONS.—Notwithstanding sub-
paragraph (A), a financial institution—
‘‘(i) shall not be required to disclose
to a consumer any confidential commercial
information, such as an algorithm used to
derive credit scores or other risk scores or
predictors;
‘‘(ii) shall not be required to create
new records in order to comply with the
consumer’s request;
‘‘(iii) shall not be required to disclose
to a consumer any information assembled
by the financial institution, in a particular
matter, as part of the financial institu-
tion’s efforts to comply with laws pre-
venting fraud, money laundering, or other
unlawful conduct; and
‘‘(iv) shall not disclose any informa-
tion required to be kept confidential by any
other Federal law.
‘‘(2) CORRECTION.—
‘‘(A) OPPORTUNITY
TO
DISPUTE.—A fi-
nancial institution shall provide a consumer the
opportunity to dispute the accuracy of any indi-
vidually identifiable health information disclosed
to the consumer pursuant to paragraph (1),
and to present evidence thereon.
‘‘(B) AMENDMENT, CORRECTION, OR DE-
LETION.—A financial institution—
‘‘(i) shall amend, correct, or delete
material information identified by a con-
sumer that is materially incomplete or in-
accurate; or
‘‘(ii) shall notify the consumer of—
‘‘(I) its refusal to make such
amendment, correction, deletion;
‘‘(II) the reasons for the refusal;
and
‘‘(III) the identity of the person
who created the information and shall
refer the consumer to that person for
purposes of amending or correcting
the information or filing with it a con-
cise statement of what the consumer
believes to be the correct information.
‘‘(3) COORDINATION AND CONSULTATION.—In
prescribing regulations implementing this subsection,
the Federal agencies specified in section 504(a) shall
consult with one another to ensure that the
regulations—
‘‘(A) impose consistent requirements on
the financial institutions under their respective
jurisdictions;
‘‘(B) take into account conditions under
which financial institutions do business both in
the United States and in other countries; and
‘‘(C) are consistent with the principle of
technology neutrality.
‘‘(4) CHARGES FOR DISCLOSURES.—A financial
institution may impose a reasonable charge for mak-
ing a disclosure under this subsection, which charge
shall be disclosed to the consumer before making the
disclosure.
‘‘(d) SPECIAL REQUIREMENT TO PROTECT MENTAL
HEALTH INFORMATION.—In any case in which this sec-
tion requires a person to obtain a consumer’s affirmative
consent to a receipt, use, or disclosure of individually iden-
tifiable health information, the person shall obtain a sepa-
rate and specific consent with respect to any information
pertaining to the mental health or mental condition of an
individual.
‘‘(e) RELATIONSHIP TO OTHER LAWS.—Nothing in
this section shall be construed as—
‘‘(1) modifying, limiting, or superseding stand-
ards promulgated by the Secretary of Health and
Human Services under—
‘‘(A) part C of title XI of the Social Secu-
rity Act (42 U.S.C. 1320d et seq.); or
‘‘(B) section 264(c) of the Health Insur-
ance Portability and Accountability Act of 1996
(Public Law 104–191; 110 Stat. 2033); or
‘‘(2) authorizing the use or disclosure of indi-
vidually identifiable health information in a manner
other than as permitted by other applicable law.’’.
(b) DEFINITION
OF INDIVIDUALLY IDENTIFIABLE
HEALTH INFORMATION.—Section 509 of the Gramm-
Leach-Bliley Act (15 U.S.C. 6809) is amended by adding
at the end the following:
‘‘(12) INDIVIDUALLY
IDENTIFIABLE
HEALTH
INFORMATION.—The term ‘individually identifiable
health information’ means any information, includ-
ing demographic information obtained from or about
an 
individual, 
that 
is 
described 
in 
section
1171(6)(B) of the Social Security Act (42 U.S.C.
1320d(6)(B)).’’.
(c) CLERICAL AMENDMENT.—The table of contents
for the Gramm-Leach-Bliley Act is amended by inserting
after the item relating to section 502 the following:
‘‘Sec. 502A. Special rules for health information.’’.
SEC. 3. REGULATIONS; EFFECTIVE DATE.
(a) REGULATIONS.—
(1) REGULATORY AUTHORITY.—Section 504(a)
of the Gramm-Leach-Bliley Act (15 U.S.C. 6804(a))
shall apply to the issuance of regulations to carry
out the amendments made by this Act in the same
manner as such section applies to the issuance of
other regulations to carry out subtitle A of title V
of the Gramm-Leach-Bliley Act, except as provided
in paragraph (4).
(2) AUTHORITY TO GRANT EXCEPTIONS.—The
regulations issued to carry out the amendments
made by this Act may include such additional excep-
tions to the provisions of section 502A of the
Gramm-Leach-Bliley Act, as inserted by section 2,
as are deemed consistent with the purposes of sub-
title A of title V of such Act, except as provided in
paragraph (3)(B).
(3) 
SPECIAL
PROTECTIONS
FOR
MENTAL
HEALTH INFORMATION.—
(A) IN GENERAL.—The regulations issued
to carry out the amendments made by this Act
shall, where appropriate, include special policies
and procedures to protect the confidentiality of
individually identifiable health information re-
lating to the mental health or mental condition
of an individual.
(B) AUTHORITY TO GRANT EXCEPTIONS.—
The regulations issued to carry out the amend-
ments made by this Act may not include any
exception to the provisions of section 502A of
the Gramm-Leach-Bliley Act, as inserted by
section 2, that diminishes the protection af-
forded by such section to the confidentiality of
individually identifiable health information re-
lating to the mental health or mental condition
of an individual.
(4) DEADLINE.—Regulations to carry out the
amendments made by this Act shall be issued in
final form not later than 6 months after the date of
the enactment of this Act.
(b) EFFECTIVE DATE.—The amendments made by
this Act shall take effect 6 months after the date on which
regulations are required to be issued under subsection
(a)(4), except to the extent that a later date is specified
in such regulations.
Æ