12 C.F.R. § 1022.31
§ 1022.31 Limits on redisclosure of information. (12 CFR Part 1022)
Operative Text
(a) Scope. This section applies to any person, except for a person excluded from coverage of this part by section 1029 of the Consumer Financial Protection Act of 2010, title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Public Law 111-203, 124 Stat. 137. (b) Limits on redisclosure. If a person described in paragraph (a) of this section receives medical information about a consumer from a consumer reporting agency or its affiliate, the person must not disclose that information to any other person, except as necessary to carry out the purpose for which the information was initially disclosed, or as otherwise permitted by statute, regulation, or order.
Under § 1022.31, when a person or entity receives a consumer's medical information from a consumer reporting agency or one of its affiliates, that information cannot be passed along to third parties. The only exceptions are when redisclosure is necessary to fulfill the original purpose for which the information was shared, or when a statute, regulation, or order specifically permits it. This rule places a firm boundary around the secondary circulation of sensitive medical data obtained through consumer reporting channels.
Plain English — not legal advice.
Property owners and managers who receive medical information about an applicant or tenant through a consumer reporting agency as part of a credit or background check are subject to the redisclosure limits set out in § 1022.31. Compliant operators generally treat such medical information as restricted, sharing it only to the extent required to complete the screening process for which it was obtained and not circulating it to other staff, affiliates, or third parties beyond that narrow purpose. Maintaining clear internal data-handling policies that reflect these limits is a common practice among operators seeking to stay within the rule's boundaries.
General guidance for property managers — not legal advice for your specific situation. Consult an attorney for advice on your case.
Section § 1022.31 gives consumers a meaningful protection: medical information that a landlord or other party receives about you from a consumer reporting agency is not supposed to be freely passed on to others. If you believe your medical information obtained through a consumer reporting agency has been shared beyond the purpose for which it was originally used, you may have grounds to raise that as a concern with the Consumer Financial Protection Bureau or a relevant regulatory body. Tenant-rights organizations and housing advocacy groups can help you understand what options may be available when this type of information-handling concern arises.
General guidance for tenants — not legal advice for your specific situation. Consult a tenant-rights organization or attorney for advice on your case.
Generated September 4, 2026 — auto-generated, not yet human-reviewed. See /transparency for methodology.
Effective Timeline
References Out
No outbound references recorded yet for this provision.
References In
No inbound references recorded yet for this provision.