We have an elderly customer. One of her children has sued another of her children in what appears to be a squabble over the customer’s money. Now, we have received a letter from a local nonprofit that provides services to elderly persons requesting the customer’s financial information (it asks us to provide a copy of a particular check). The letter states that it is from “Adult Protective Services,” but it does not list a government agency and is not a court order. We are not aware of any circumstances that would suggest elder financial exploitation. Are we required to respond to this request?

No, we do not believe that your bank is required to provide your customer’s private financial information to the local nonprofit in response to its letter.

Illinois law permits, but does not require, financial institutions to report suspected elder financial exploitation to the Illinois Department on Aging (DoA) or to the DoA’s “provider agencies.” The nonprofit that sent you the request does not appear on the DoA’s public list of its provider agencies, and in any event, your bank is not required to respond to such a request.

Also, there could be some risks if your bank were to decide to voluntarily disclose this information without your customer’s consent. The Illinois Banking Act authorizes the disclosure of private financial information when financial exploitation is suspected, but only to “law enforcement authorities, the Illinois Department on Aging and its regional administrative and provider agencies, the Department of Human Services Office of Inspector General, or public guardians.” While the letter you received arguably provides your bank with sufficient reason to suspect financial exploitation of your customer, the local nonprofit is not covered by this authorization because it has not been designated by the DoA as a regional administrative or provider agency.

Theoretically, your bank also could rely on Regulation P for disclosing your customer’s financial information in a situation like this one. Regulation P permits financial institutions to disclose nonpublic personal information in order to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability. (Other exceptions in the regulation appear to be irrelevant here, such as the exception for disclosing information in response to a subpoena.) Arguably, your institution could rely on this exception to protect your customer against the possibility of financial exploitation — but this exception does not require disclosure.

There also could be other risks in addition to privacy considerations, particularly in the context of the ongoing litigation involving your customer’s funds. Generally, the Adult Protective Services Act (“Act”) provides civil and criminal immunity to persons reporting suspected financial abuse of an “eligible adult.” However, the safe harbor does not apply if the alleged victim is not an “eligible adult,” and that term excludes individuals living in many types of nursing home facilities (see below). If the customer lives in one of those facilities, your bank would not qualify for the Act’s safe harbor from potential criminal or civil liability for making a report.

For resources related to our guidance, please see:

Adult Protective Services Act, 320 ILCS 20/4(a) (“Any person who suspects the abuse, neglect, financial exploitation, or self-neglect of an eligible adult may report this suspicion to an agency designated to receive such reports under this Act or to the Department.”)
Adult Protective Services Act, 320 ILCS 20/2(h) (“‘Provider agency’ means any public or nonprofit agency in a planning and service area that is selected by the Department or appointed by the regional administrative agency with prior approval by the Department on Aging to receive and assess reports of alleged or suspected abuse, neglect, or financial exploitation. A provider agency is also referenced as a ‘designated agency’ in this Act.”)
Adult Protective Services Act, 320 ILCS 20/2(f-5) (The definition of “mandated reporter” does not include financial institutions or their employees.)
Illinois Banking Act, 205 ILCS 5/48.1(b)(16) (The prohibition on disclosing a customer’s financial records does not apply to the “furnishing of information to law enforcement authorities, the Illinois Department on Aging and its regional administrative and provider agencies, the Department of Human Services Office of Inspector General, or public guardians: (i) upon subpoena by the investigatory entity or the guardian, or (ii) if there is suspicion by the bank that a customer who is an elderly person or person with a disability has been or may become the victim of financial exploitation.”)
Regulation P, 12 CFR 1016.15(a)(7) (Exceptions to the opt-out requirements include the disclosure of nonpublic personal information “(i) To comply with Federal, state, or local laws, rules and other applicable legal requirements; (ii) To comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, state, or local authorities; or (iii) To respond to judicial process or government regulatory authorities having jurisdiction over you for examination, compliance, or other purposes as authorized by law.”)
Regulation P, 12 CFR 1016.15(a)(2) (Exceptions to the opt-out requirements include the disclosure of nonpublic personal information “(i) To protect the confidentiality or security of your records pertaining to the consumer, service, product, or transaction; (ii) To protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability; (iii) For required institutional risk control or for resolving consumer disputes or inquiries; (iv) To persons holding a legal or beneficial interest relating to the consumer; or (v) To persons acting in a fiduciary or representative capacity on behalf of the consumer; . . .”)
Adult Protective Services Act, 320 ILCS 20/4(a-7) (“A person making a report under this Act in the belief that it is in the alleged victim’s best interest shall be immune from criminal or civil liability or professional disciplinary action on account of making the report, notwithstanding any requirements concerning the confidentiality of information with respect to such eligible adult which might otherwise be applicable.”)
Adult Protective Services Act, 320 ILCS 20/2(e) (“‘Eligible adult’ means either an adult with disabilities aged 18 through 59 or a person aged 60 or older who resides in a domestic living situation . . . .”)
Adult Protective Services Act, 320 ILCS 20/2(d) (“‘Domestic living situation’ means a residence where the eligible adult at the time of the report lives alone or with his or her family or a caregiver, or others, or other community-based unlicensed facility, but is not:

(1) A licensed facility as defined in Section 1-113 of the Nursing Home Care Act;

(1.5) A facility licensed under the ID/DD Community Care Act
(1.6) A facility licensed under the MC/DD Act
(1.7) A facility licensed under the Specialized Mental Health Rehabilitation Act of 2013
(2) A ‘life care facility’ as defined in the Life Care Facilities Act
(3) A home, institution, or other place operated by the federal government or agency thereof or by the State of Illinois;

(4) A hospital, sanitarium, or other institution, the principal activity or business of which is the diagnosis, care, and treatment of human illness through the maintenance and operation of organized facilities therefor, which is required to be licensed under the Hospital Licensing Act
(5) A ‘community living facility’ as defined in the Community Living Facilities Licensing Act
(6) (Blank);

(7) A ‘community-integrated living arrangement’ as defined in the Community-Integrated Living Arrangements Licensure and Certification Act or a ‘community residential alternative’ as licensed under that Act;

(8) An assisted living or shared housing establishment as defined in the Assisted Living and Shared Housing Act
(9) A supportive living facility as described in Section 5-5.01a of the Illinois Public Aid Code.”)