A payment-plan scoring tool can be a credit decision.

The intake asked whether the AI makes or influences credit decisions, and the answer was yes: scoring, underwriting, approval or denial, pricing, or adverse action. That answer, with the US footprint, selects ECOA, which returned four obligations, including the adverse-action notice with specific reasons even when a model decided. One limit to read with them: each stored ECOA duty says "Where [the tool] is used by a creditor ...", and the intake does not ask whether the organization is a creditor. The product establishes the tool-level fact; whether a payment plan makes a health system a creditor is for counsel.

• Notify adverse action within 30 days with specific principal reasons, even when a model decided12 C.F.R. § 1002.9ECOA
• Evaluate applications without taking a prohibited basis into account; use age only as Reg B permits12 C.F.R. § 1002.6ECOA
• Do not discriminate on a prohibited basis in any aspect of a credit transaction, or discourage applicants12 C.F.R. § 1002.4ECOA

FCRA is selected because the decision domain is credit, the footprint is US and the tool uses a consumer reporting agency's report. Five obligations are shown. One is written for a user of consumer reports: the adverse-action notice. The other four run along the chain: accuracy and dispute investigation as duties of the reporting agency, inaccurate inputs as a duty of a furnisher, and a classification to make if the vendor itself aggregates consumer data. The determination lists them because the report is used; it does not establish that the health system or its vendor is a reporting agency or a furnisher.

• Requirements on users of consumer reports — adverse-action notices15 U.S.C. § 1681m (FCRA § 615 — requirements on users of consumer reports)FCRA
• Accuracy — reasonable procedures to assure maximum possible accuracy15 U.S.C. § 1681e(b) (FCRA § 607(b) — maximum possible accuracy)FCRA
• Dispute investigation15 U.S.C. § 1681i (FCRA § 611 — procedure in case of disputed accuracy)FCRA
• FCRA — AI vendor aggregating consumer data for downstream FCRA permissible-purpose use without CRA compliance15 U.S.C. § 1681a (FCRA § 603 — definitions)FCRA

The declared data types include protected health information and financial data, so HIPAA returned nine obligations and HITECH one: the business associate agreement, the administrative, physical and technical safeguards over the ePHI inside the system, the minimum-necessary standard and the patient's right to electronic copies. These are not specific to patient financing; they follow the data.

• Check the business associate agreement for Patient Financing Eligibility Assistant against 45 C.F.R. § 164.504(e)45 C.F.R. § 164.502(e)HIPAA
• Minimum necessary - limit ePHI uses, disclosures, and requests to the minimum needed (45 CFR § 164.502(b))45 C.F.R. § 164.502(b)HIPAA
• Strengthened right of access — electronic copies45 C.F.R. § 164.524HITECH

The determination shows six obligations under the automated decision-making regulations: a risk assessment before the tool is used for a significant decision, with the vendor's logic and outputs carried into it, and the assessment information submitted to the Privacy Protection Agency; and, from 2027, a pre-use notice, an opt-out or human appeal, and answers to access requests. Under the CCPA it shows six more, among them a risk assessment before sensitive personal information is processed and the service-provider terms in the vendor agreement.

• Conduct a risk assessment before using Patient Financing Eligibility Assistant as ADMT for a significant decision (11 CCR § 7150(b)(3))11 CCR § 7150(b)(3)California ADMT
• Risk assessment information must be submitted to the California Privacy Protection Agency on the regulatory schedule (11 CCR § 7157)11 CCR § 7157California ADMT
• Opt-out of ADMT, or a qualifying human appeal (by January 1, 2027)11 CCR § 7221California ADMTfrom January 1, 2027
• Complete a California Consumer Privacy Act risk assessment before Patient Financing Eligibility Assistant processes sensitive PICal. Code Regs. tit. 11, § 7150(b)(2)CCPA / CPRA
• Confirm the Patient Financing Eligibility Assistant vendor agreement meets the required service-provider or contractor termsCal. Civ. Code § 1798.100(d)CCPA / CPRA

Four of the eleven selected laws show no obligation: California AB 3030, California SB 942, the New York SHIELD Act and the SEC's AI examination priorities. On all four, obligations exist and are held pending citation verification, and one AB 3030 question was not answered; none is shown, which is not the same as none existing. Across this determination 49 obligations are held that way, including 5 under ECOA and 2 under FCRA, so the lists above are what is currently shown, not everything the law may ask. GLBA was selected on a derived fact, from the credit-decision answer and the declared industry, while the declared institution class is not applicable; one GLBA duty is shown.

• Protection of nonpublic personal information — GLBA § 501 security and confidentiality mandate (15 U.S.C. § 6801)15 U.S.C. § 6801GLBA