(a) Scope. This section applies to State banks insured by the FDIC (other than members of the Federal Reserve System) and insured State branches of foreign banks.
(b) Limits on redisclosure. If a person described in paragraph (a) of this section receives medical information about a consumer from a consumer reporting agency or its affiliate, the person must not disclose that information to any other person, except as necessary to carry out the purpose for which the information was initially disclosed, or as otherwise permitted by statute, regulation, or order.