While the FCRA and Regulation V specifically use the term "consumer" in the medical information rule, this should be interpreted in the context of the FCRA as a whole. The FTC has taken the position that when you use a consumer credit report for a business purpose loan, the consumer protections of the FCRA all apply to the consumer/business owner. Thus, the medical rule would be applicable even though the loan is business purpose.
Having said that, medical information must not be used except when it is relevant to the credit decision. In this situation you have information that would appear to be prohibited but is in fact affecting the borrower's performance. I think that in this isolated situation, you could consider the information to evaluate the risk but that, in doing so, you must keep the information confidential.