Author: Gary Johnson, Chief Growth Officer, Curae®
Published: 10/28/26 | Last Reviewed: 10/26/26
Reading Time: Approximately 10 minutes
Regulation B, enacted under the Equal Credit Opportunity Act, prohibits any creditor from discriminating against credit applicants on the basis of race, color, religion, national origin, sex, marital status, age, or receipt of public assistance. When a patient financing partner screens patients using criteria that function as proxies for these protected characteristics, including zip code, neighborhood, or algorithmic risk scores built on demographically correlated data, the health system that deploys that financing program faces direct regulatory exposure, brand damage, and potential legal liability, even if the health system did not design the screening criteria. Health systems have a legal and ethical obligation to ensure that their patient financing partner operates under a federally regulated compliance framework that guarantees equal credit opportunity to every patient who applies. CURAEPay, the patient financing solution managed by Curae, approves up to 90% of applicants under a federally regulated credit framework governed by both Regulation B and Regulation Z, with audited compliance practices and adverse action notice requirements that protect both patients and the health systems that serve them.
When health system CFOs and revenue cycle leaders evaluate patient financing partners, they typically focus on eligibility rates, funding timelines, recourse structure, and implementation speed. These are the right dimensions to evaluate. But there is a dimension that belongs at the top of the evaluation framework that most health systems have not explicitly mapped: regulatory compliance with equal credit opportunity law, and the specific risk that a financing partner’s patient screening methodology could constitute illegal discrimination.
This is not a theoretical risk. It is an active regulatory and legal exposure that has produced enforcement actions, litigation, and significant institutional reputational damage in the consumer lending industry. As patient financing becomes a larger and more visible component of health system revenue strategy, regulatory scrutiny of consumer lending is following the dollars into healthcare.
The health system that deploys a patient financing program does not disappear from the regulatory picture simply because a third-party vendor manages the credit decisions. From the patient’s perspective, and from the regulator’s perspective, the financing offer is made in the context of the health system encounter. The health system’s brand is on the interaction. Health system staff initiate the offer. If a patient is denied financing based on criteria that function as proxies for race, national origin, or other protected characteristics, the reputational and legal consequences will fall on the health system as well as the financing partner.
Understanding the specific discrimination risks embedded in patient financing program design and knowing what to look for when evaluating a financing partner’s compliance framework is now an essential component of health system financial and legal due diligence.
Regulation B implements the Equal Credit Opportunity Act (ECOA), a federal law that prohibits discrimination in any aspect of a credit transaction. It applies to any entity that regularly extends credit, including patient financing companies that offer revolving lines of credit or installment loans for healthcare services.
Regulation B’s core prohibition is broad. A creditor may not discriminate against any applicant on the basis of race, color, religion, national origin, sex, marital status, age, receipt of income from a public assistance program, or the fact that the applicant has exercised rights under the Consumer Credit Protection Act. Discrimination can be direct, meaning explicitly using a prohibited characteristic in a credit decision, or it can be disparate impact discrimination, meaning using a facially neutral criterion that has a disproportionate adverse effect on a protected class without a legitimate business justification.
The disparate impact dimension poses the greatest risk for patient financing programs. A financing partner that declines patients based on zip code, for example, may not be explicitly using race as a criterion. But if zip code functions as a proxy for race or national origin in the relevant geographic market, and if patients in certain zip codes are systematically declined financing that patients in other zip codes receive, the result is functionally equivalent to racial discrimination in credit access. This practice, historically known as redlining, remains illegal regardless of whether the discriminatory outcome is intentional.
Beyond the non-discrimination requirement, Regulation B imposes specific procedural obligations on creditors. When a credit application is denied or approved on less favorable terms, the creditor must provide an adverse action notice that informs the applicant of the specific reasons for the decision, within a defined timeframe. Failure to provide compliant adverse action notices is an independent Regulation B violation, regardless of whether the underlying credit decision was discriminatory.
Regulation Z, the implementing regulation for the Truth in Lending Act, adds a second layer of compliance obligation: disclosing credit terms clearly and accurately, including the annual percentage rate, fees, and repayment schedule, before the credit transaction is consummated. A patient financing program that obscures its true cost of credit, through deferred interest structures, hidden fees, or ambiguous APR disclosures, violates Regulation Z. And a health system whose financing partner operates a non-compliant program has endorsed that program to its patients.
Not all patient screening methodologies create equal regulatory risk. Understanding which specific practices elevate discrimination exposure is the starting point for health system due diligence on a financing partner’s compliance framework.
Zip code-based screening. Using a patient’s zip code as an input into credit eligibility decisions is among the highest-risk screening practices in consumer lending. In most U.S. metropolitan markets, residential zip codes correlate strongly with race and national origin because of historical patterns of residential segregation. A financing program that declines applicants from certain zip codes or applies higher discount rates to applicants from certain geographic areas is using a criterion that functions as a racial proxy. This is a textbook disparate impact discrimination pattern, and it has been the basis of enforcement actions by the Consumer Financial Protection Bureau and the Department of Justice in consumer lending contexts.
Algorithmic risk scoring built on demographically correlated data. Machine learning credit models trained on historical data can produce discriminatory outcomes even when protected characteristics are not explicitly included as model inputs. If the historical data used to train the model reflects prior discriminatory lending patterns, the model will learn and replicate those patterns. A patient financing program that uses a proprietary algorithmic scoring model without audited fairness testing and disparate impact analysis operates with unquantified discrimination risk that neither the financing partner nor the health system may identify until an enforcement action or litigation surfaces it.
Selective offer practices based on balance size or service line. A financing program that offers credit only to patients with balances above a certain threshold, or only to patients in certain service lines, may create disparate impact discrimination if patients with smaller balances or in certain service lines are disproportionately from protected classes. For example, if a financing program systematically declines patients with balances under $500 and those patients are disproportionately from lower-income communities that correlate with protected characteristics, the screening criterion produces a discriminatory outcome regardless of intent.
Inconsistent application of eligibility criteria. Regulation B requires applying credit eligibility criteria consistently to all applicants. A financing program that applies its stated eligibility criteria inconsistently, approving some applicants who do not meet the criteria while declining others who do, based on factors that correlate with protected characteristics, is in direct violation of Regulation B regardless of whether the inconsistency is deliberate.
Health system leaders sometimes assume that because the financing partner makes the credit decision, the regulatory and reputational risk of a discriminatory financing program belongs entirely to that partner. This assumption is incorrect, and acting on it can have severe consequences.
From the patient’s perspective, the health system made the financing offer. The interaction happened in a health system facility, facilitated by health system staff, during a health system encounter. The patient did not seek out the financing company directly. The health system brought the financing company into the patient relationship. When the patient is denied financing based on criteria they experience as discriminatory, the health system is the institution they hold responsible.
From a legal perspective, ECOA and Regulation B apply to any entity that participates in a credit decision, not only the entity that makes the final credit determination. A health system that refers patients to a financing program, that facilitates the application process, or that markets the financing program to its patients may be considered a participant in the credit transaction with its own compliance obligations. Regulators and plaintiffs’ attorneys have successfully extended ECOA liability to referring entities in consumer lending contexts outside healthcare. There is no reason to assume that healthcare patient financing will be treated differently as regulatory scrutiny increases.
From a reputational perspective, the brand damage of a discrimination finding in a patient financing program is compounded by the healthcare context. A health system that is found to have deployed a patient financing program that systematically denied credit to patients in predominantly minority communities will face a community trust crisis that is qualitatively different from the reputational damage a bank would face for the same finding. The mission of a health system is to provide care to its community. A finding that the health system’s financing program denied care access on the basis of race or national origin is a direct contradiction of that mission, and the reputational consequences will be proportionate to that contradiction.
A patient financing program that is genuinely compliant with Regulation B and Regulation Z looks different from a program that merely claims compliance. Health system CFOs and legal counsel evaluating a financing partner should look for the following specific compliance features.
Federal regulatory standing with an audited compliance program. A financing partner that operates under federal banking regulations and maintains a independently audited compliance program provides a materially higher level of assurance than a partner that relies on state-by-state licensing. Federal regulatory frameworks apply uniform standards across all markets, eliminating the geographic variation in credit access that state-licensed programs can produce. CURAEPay is managed by Curae, a subsidiary of Atlanticus Holdings Corporation (Nasdaq: ATLC), with credit lines issued by a federally regulated bank, operating under both Regulation B and Regulation Z with audited compliance practices.
Broad, consistent eligibility criteria applied uniformly. A financing program with a 90%+ approval rate, applied consistently across all patient demographics, service lines, and balance sizes, is far less likely to produce disparate impact discrimination than a program with a narrow eligibility threshold that systematically excludes lower-income or higher-risk patients. Broad eligibility is not only a financial performance advantage. It is a compliance advantage, because it reduces the population of declined patients among whom a disparate impact pattern could be identified.
Compliant adverse action notices on every declined application. Every patient who is declined financing must receive a Regulation B-compliant adverse action notice specifying the reasons for the decision within the required timeframe. A financing partner that cannot demonstrate a systematic adverse action notice process is not Regulation B compliant, regardless of what its marketing materials claim.
Transparent, fully disclosed credit terms. Every patient who accepts financing must receive a Regulation Z-compliant disclosure of all credit terms before the transaction is consummated. This includes the true APY, all fees, and the repayment schedule. A financing program with deferred interest structures, hidden fees, or ambiguous APR disclosures is not Regulation Z compliant and exposes both the financing partner and the health system to Truth in Lending Act liability.
No zip code, neighborhood, or demographic proxy inputs in eligibility determination. Ask the financing partner directly whether zip code, geographic area, or any criterion that correlates with race or national origin is used in credit eligibility determinations. Request documentation of the eligibility criteria and, if the program uses algorithmic scoring, request evidence of disparate impact testing and fairness auditing. A financing partner that cannot or will not provide this documentation is a financing partner whose compliance framework cannot be verified.
What is Regulation B and how does it apply to patient financing? Regulation B is the implementing regulation for the Equal Credit Opportunity Act, a federal law that prohibits discrimination in any aspect of a credit transaction. It applies to any entity that regularly extends credit, including patient financing companies that offer revolving lines of credit or installment loans for healthcare services. Under Regulation B, a creditor may not discriminate against any applicant on the basis of race, color, religion, national origin, sex, marital status, age, or receipt of public assistance. Discrimination can be direct, or it can be disparate impact discrimination, meaning using a facially neutral criterion that has a disproportionate adverse effect on a protected class without a legitimate business justification.
Can a patient financing company use zip code to screen patients for credit eligibility? Using zip code as an input into credit eligibility decisions is among the highest-risk screening practices in consumer lending from a Regulation B perspective. In most U.S. metropolitan markets, residential zip codes correlate strongly with race and national origin because of historical patterns of residential segregation. A financing program that declines patients from certain zip codes or applies less favorable terms to patients in certain geographic areas, is using a criterion that functions as a racial proxy. This practice is historically known as redlining, and it remains illegal under Regulation B regardless of whether the discriminatory outcome is intentional.
Does a health system face legal risk if its patient financing partner discriminates against patients? Yes. ECOA and Regulation B can apply to any entity that participates in a credit transaction, not only the entity that makes the final credit determination. A health system that refers patients to a financing program, facilitates the application process, or markets the financing program to its patients may be considered a participant in the credit transaction with its own compliance obligations. Beyond legal exposure, the health system bears full reputational risk: from the patient’s perspective, the financing offer was made by their health system, and a discrimination finding will damage the health system’s community trust regardless of which entity made the credit decision.
What is an adverse action notice and why is it required? An adverse action notice is a written notification that a creditor must provide to a credit applicant when a credit application is denied or approved on less favorable terms. Under Regulation B, the notice must specify the specific reasons for the adverse action and must be provided within a defined timeframe. Failure to provide compliant adverse action notices is an independent Regulation B violation, separate from and in addition to any substantive discrimination violation. A patient financing partner that cannot demonstrate a systematic adverse action notice process is not Regulation B compliant.
What is Regulation Z and how does it apply to patient financing? Regulation Z is the implementing regulation for the Truth in Lending Act. It requires creditors to disclose credit terms clearly and accurately, including the annual percentage rate, all fees, and the repayment schedule, before a credit transaction is consummated. A patient financing program with deferred interest structures, hidden fees, or ambiguous APR disclosures violates Regulation Z. Health systems whose financing partners operate non-compliant programs have endorsed those programs to their patients and face associated liability.
What should health systems look for when evaluating a patient financing partner’s compliance framework? Health systems evaluating a patient financing partner’s compliance framework should look for five specific features: federal regulatory standing with an independently audited compliance program; broad, consistent eligibility criteria applied uniformly across all patient demographics, service lines, and balance sizes; compliant adverse action notices on every declined application; transparent, fully disclosed credit terms meeting Regulation Z requirements; and explicit confirmation that zip code, neighborhood, or other demographic proxy criteria are not used in credit eligibility determinations. A financing partner that cannot or will not document these features cannot be verified as compliant.
How does CURAEPay’s compliance framework protect health systems from discrimination liability? Curae, a subsidiary of Atlanticus Holdings Corporation (Nasdaq: ATLC), manages CURAEPay, with credit lines issued by a federally regulated bank. CURAEPay operates under both Regulation B and Regulation Z with audited compliance practices that apply uniform eligibility standards across all patient demographics, service lines, and geographic areas. The program’s up to 90%+ approval rate, applied consistently across the full patient population, reduces the risk of disparate impact discrimination findings by minimizing the population of declined patients among whom a discriminatory pattern could be identified. We provide adverse action notices on all declined applications in accordance with Regulation B requirements.
What is disparate impact discrimination in credit and how does it occur in patient financing? Disparate impact discrimination occurs when a facially neutral credit criterion has a disproportionate adverse effect on members of a protected class without a legitimate business justification. In patient financing, disparate impact discrimination can occur through zip code-based screening, algorithmic risk scoring built on demographically correlated historical data, selective offer practices that systematically exclude patients from certain demographics, or inconsistent application of eligibility criteria. Unlike direct discrimination, disparate impact discrimination does not require discriminatory intent. A financing program can produce illegal disparate impact outcomes through criteria that appear neutral on their face but function as proxies for race, national origin, or other protected characteristics.
References and Sources
Curae® is a registered trademark of Curae Finance, LLC. CURAEPay is the patient financing solution managed by Curae within its Patient Financial Access Platform, which also includes CURAEAdvocate (ACA premium sponsorship) and CURAEClear (insurance discovery and Medicare underpayment recovery). For more on how non-recourse patient financing works, see What Is Non-Recourse Patient Financing and Why Health Systems Are Switching. To learn how CURAEPay can reduce bad debt and improve patient collections at your organization, visit curae.com.