The FACT Act requires the agencies to prescribe regulations that permit creditors to obtain and use medical information for eligibility purposes when necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs.