42 U.S.C. § 1320d–8. Processing payment transactions by financial institutions

To the extent that an entity is engaged in activities of a financial institution (as defined in section 3401 of title 12), or is engaged in authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments, for a financial institution, this part, and any standard adopted under this part, shall not apply to the entity with respect to such activities, including the following:

1. (1)
   (1)The use or disclosure of information by the entity for authorizing, processing, clearing, settling, billing, transferring, reconciling or collecting, a payment for, or related to, health plan premiums or health care, where such payment is made by any means, including a credit, debit, or other payment card, an account, check, or electronic funds transfer.
2. (2)
   (2)

   The request for, or the use or disclosure of, information by the entity with respect to a payment described in paragraph (1)—

   1. (A)
      (2)(A)for transferring receivables;
   2. (B)
      (2)(B)for auditing;
   3. (C)
      (2)(C)

      in connection with—

      1. (i)
         (2)(C)(i)a customer dispute; or
      2. (ii)
         (2)(C)(ii)an inquiry from, or to, a customer;
   4. (D)
      (2)(D)in a communication to a customer of the entity regarding the customer’s transactions, payment card, account, check, or electronic funds transfer;
   5. (E)
      (2)(E)for reporting to consumer reporting agencies; or
   6. (F)
      (2)(F)

      for complying with—

      1. (i)
         (2)(F)(i)a civil or criminal subpoena; or
      2. (ii)
         (2)(F)(ii)a Federal or State law regulating the entity.