S.J. Res. 36 is a Congressional Review Act joint resolution that declares the Bureau of Consumer Financial Protection's rule titled "Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V)" (90 Fed.
Reg. 3276, Jan. 14, 2025) to have "no force or effect." The text is a straightforward disapproval: it identifies the rule and states Congress disapproves it.
If enacted, the joint resolution would eliminate the new regulatory prohibition the CFPB attempted to impose on creditors and consumer reporting agencies regarding medical information. That outcome alters the compliance landscape for financial institutions, credit reporting agencies, and entities that handle medical-related data tied to credit, and it raises immediate questions about legal gaps in medical privacy protections in the consumer-finance context.
At a Glance
What It Does
The resolution uses the Congressional Review Act to disapprove the CFPB's Regulation V rule on medical information and declares that rule to have no force or effect. It targets the specific Federal Register entry (90 Fed. Reg. 3276) and nullifies that rule if the resolution becomes law.
Who It Affects
The measure directly affects the CFPB's regulatory reach and any entities subject to Regulation V—primarily consumer reporting agencies, creditors, debt buyers, and financial institutions that might rely on medical-related information in credit decisions or reporting. Indirectly it affects consumers whose medical information could appear in credit files and entities that advise on compliance and data governance.
Why It Matters
A successful disapproval would erase a new federal restriction on the use and reporting of medical information in consumer finance and block the CFPB from reissuing the same rule in substantially the same form without new congressional authorization. That shifts where the question of medical privacy in credit reporting will be settled—back toward statute, state law, or agency discretion under different constraints.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
This joint resolution invokes the Congressional Review Act (CRA) to overturn a CFPB rule titled "Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V)." The bill text is short: it names the rule by title and Federal Register citation and states that Congress disapproves the rule and that the rule shall have no force or effect.
Under the CRA, a congressional disapproval resolution that becomes law not only voids the targeted regulation but also generally prevents the issuing agency from promulgating a replacement "in substantially the same form" unless Congress authorizes it by law. The practical result of enacting S.J.
Res. 36 would be to remove the newly established CFPB prohibition from the federal regulatory code and to make it more difficult for the CFPB to restore that same prohibition without fresh legislative authority.For regulated entities, the immediate compliance effect is predictable: obligations created by the CFPB rule would disappear, returning the legal baseline to whatever pre-rule Regulation V and related statutes required. For consumers and privacy advocates, nullification means a lost layer of protection on how medical information is handled in credit reporting and by creditors.
For the CFPB, passage would be a check on its exercise of delegated authority and would narrow an avenue for addressing medical-info harms in the consumer-finance system.The resolution does not amend the underlying statutes such as the Fair Credit Reporting Act or HIPAA, nor does it itself create alternative safeguards; it simply withdraws the CFPB's regulatory change. That leaves open where and how medical-information concerns in the credit context will be addressed going forward—by future rulemaking under different constraints, litigation, or congressional statute.
The Five Things You Need to Know
The resolution explicitly disapproves the CFPB rule titled "Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V)," published at 90 Fed. Reg. 3276 (Jan. 14, 2025).
If enacted, the resolution declares the CFPB rule to have "no force or effect," thereby removing it from the body of effective federal regulations.
Under the Congressional Review Act, a successful disapproval typically bars the agency from issuing a new rule in "substantially the same form" without subsequent congressional authorization.
The joint resolution is a simple, single-purpose measure and does not replace the CFPB rule with alternative statutory requirements or create new protections for medical information.
Because Regulation V is the CFPB's implementation of the Fair Credit Reporting Act's framework, nullifying this rule would revert the regulatory baseline to pre-rule interpretations and enforcement practices governed by the FCRA and other existing laws.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Express congressional disapproval of the cited rule
This section names the rule by title and Federal Register citation and states that Congress disapproves it. Practically, that language is the operative disapproval text required under the CRA: identify the rule precisely so the statute applies to the intended regulatory action.
Legal consequence: rule has no force or effect
This sentence declares the disapproved rule to "have no force or effect." In CRA practice, that nullification means the rule cannot be enforced or applied going forward, and it is removed from the set of effective federal regulations. The provision does not purport to amend the Fair Credit Reporting Act, HIPAA, or other statutes; it functions solely to invalidate the specified administrative action.
Practical implication for agency rulemaking (CRA mechanics)
By targeting the CFPB regulation via CRA disapproval, the resolution invokes the CRA's secondary consequence: the agency is generally barred from issuing a new rule in substantially the same form unless Congress provides new authorization. That means even if the CFPB sought to cure legal defects that prompted Congress' action, the agency would face a higher hurdle if it tried to return the same policy using the same regulatory approach.
This bill is one of many.
Codify tracks hundreds of bills on Finance across all five countries.
Explore Finance in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Creditors and lenders — They avoid a new federal prohibition on using or reporting medical-related information for credit decisions, preserving existing underwriting and collections practices.
- Consumer reporting agencies (credit bureaus) — They escape new restrictions on the content and handling of consumer files tied to medical information and avoid near-term reengineering of data practices.
- Debt buyers and collection firms — These actors maintain access to the same credit-file data sources and are not forced to alter data acquisition, retention, or reporting workflows as the CFPB rule would have required.
Who Bears the Cost
- Consumers with medical privacy concerns — Nullifying the CFPB prohibition can leave consumers more exposed to medical information appearing in credit files or being used in lending decisions without the new protections the rule would have provided.
- CFPB and federal consumer-protection advocates — The agency loses an enforcement tool it identified to address harms tied to medical information in consumer finance, constraining administrative approaches to those harms.
- Compliance officers and legal teams at financial institutions — While some immediate costs fall away, uncertainty increases because firms must track whether Congress will codify changes or whether alternative regulatory actions will follow, complicating medium-term compliance planning.
Key Issues
The Core Tension
The bill forces a classic trade-off: prioritize consumer medical privacy by empowering the CFPB to restrict how creditors and credit bureaus use medical information, or prioritize predictability and industry flexibility by stripping that new administrative restriction—there is no single policy lever in the resolution that reconciles both goals, and whichever side Congress picks leaves substantial unresolved questions about where protections will come from next.
The resolution is legally narrow but strategically consequential. It does not adjudicate whether the CFPB's rule was a correct exercise of authority; it simply removes the regulatory result.
That creates an implementation gap: if Congress disapproves, it relieves regulated entities of the CFPB's new obligations but leaves unresolved whether statutory law (FCRA, HIPAA) already addresses the underlying concerns or whether new legislation is needed to fill any gap. The CRA's bar on reissuing "substantially the same" rule also produces uncertainty about how the CFPB could respond—would the agency pursue a materially different regulatory design, seek congressional authorization, or refrain from further action and rely on enforcement under existing authorities?
There are predictable legal and operational frictions. The phrase "substantially the same form" has generated litigation in past CRA contexts, so disputes could arise over whether subsequent agency guidance or a modified rule violates the CRA restriction.
In addition, the resolution leaves intact potential tensions between credit-reporting practices and health-privacy statutes: nullifying a CFPB prohibition does not change HIPAA's scope, but it may increase reliance on sectoral or state privacy protections rather than a uniform federal regulatory approach. Finally, the resolution's simplicity masks a policy trade-off: it resolves an administrative disagreement quickly but transfers the debate to the legislative arena or to ad hoc enforcement, prolonging uncertainty for consumers and industry alike.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.