Red Flag Rule: What are the Address Discrepancy Obligations for a Health Care Provider That Uses Credit Reports?

 Report home | Read the report (PDF) | Previous section | Next section

The Address Discrepancy rule requires a user of a consumer report (credit report) to develop and implement reasonable policies and procedures to enable the user to deal with an address discrepancy. These requirements are narrower than the Red Flag rule for creditors. However, applicability of the address discrepancy requirement may affect a broader class of health care provider (and health insurers) than the Red Flag rule.

The address discrepancy requirement attaches to any user of a nationwide credit report. The user must be prepared to take appropriate action when a request to for a credit report results in a Notice of Address Discrepancy. When the address of a consumer supplied by the user as part of the request for a credit report differs substantially from the address in the credit bureau files, the bureau notifies the user of the existence of the discrepancy.

When the user receives an address discrepancy notice, it must have reasonable policies and procedures designed to enable the user to form a reasonable belief that a consumer report relates to the consumer about whom it has requested the report. The rule provides these examples of reasonable policies and procedures:

(i) Comparing the information in the consumer report provided by the consumer reporting agency with information the user:

(A) Obtains and uses to verify the consumer’s identity in accordance with the requirements of the Customer Information Program (CIP) rules implementing 31 U.S.C. 5318(l) (31 CFR 103.121);

(B) Maintains in its own records, such as applications, change of address notifications, other customer account records, or retained CIP documentation; or

(C) Obtains from third-party sources; or

(ii) Verifying the information in the consumer report provided by the consumer reporting agency with the consumer. 16 C.F.R. § 681.1(c)(2).

The user of a credit report must develop and implement reasonable policies and procedures for furnishing to the consumer reporting agency from whom it received the Notice of Address Discrepancy an address for the consumer that the user has reasonably confirmed is accurate Notice of Address Discrepancy when the user:

(i) Can form a reasonable belief that the consumer report relates to the consumer about whom the user requested the report;

(ii) Establishes a continuing relationship with the consumer; and

(iii) Regularly and in the ordinary course of business furnishes information to the consumer reporting agency from which the notice of address discrepancy relating to the consumer was obtained. 16 C.F.R. § 681.1(d)(1).

The rule again provides examples of confirmation methods. A user may reasonably confirm an address is accurate by:

(i) Verifying the address with the consumer about whom it has requested the report;

(ii) Reviewing its own records to verify the address of the consumer;

(iii) Verifying the address through third-party sources; or

(iv) Using other reasonable means. 16 C.F.R. § 681.1(d)(2).

Again, applicability of the address discrepancy requirement may affect a broader class of health care providers and health insurers than the Red Flag rule.

Roadmap: Red Flag and Address Discrepancy Requirements – Suggestions for Health Care Providers: IV. What are the Address Discrepancy Obligations for a Health Care Provider That Uses Credit Reports?

 Report home | Read the report (PDF) | Previous section | Next section