In today’s healthcare environment, managing unpaid bills is a critical part of a provider’s financial health. However, providers and their billing partners must navigate a complex web of medical debt collection laws to stay compliant with federal privacy rules and consumer-protection regulations. Failure to comply can lead to costly penalties, patient distrust, and reputational damage.
This guide explains how medical billing compliance intersects with HIPAA, what happens when a medical bill is sent to collections, and how healthcare collection services can operate within the latest federal and state frameworks—including the 2025 Consumer Financial Protection Bureau (CFPB) Final Rule that transforms how medical debts appear (or no longer appear) on credit reports.
By understanding the evolving landscape of medical debt laws, providers can maintain compliance, streamline their collections process, and protect both patients and their practice.
Why Medical Debt Collection Laws Matter
Medical bills are unlike other consumer debts. They involve protected health information (PHI) and are subject to unique regulatory requirements. A routine collections process can easily cross into non-compliance if privacy safeguards are ignored or if inaccurate debt information reaches credit agencies.
Healthcare organizations should pay close attention to these compliance factors:
- HIPAA privacy requirements: While sending a medical bill to collections is allowed under the Health Insurance Portability and Accountability Act, disclosures of PHI must comply with 45 C.F.R. § 164.506, which restricts the information a provider may share with third-party collectors.
- Regulatory scrutiny: The CFPB’s January 2025 final rule now bans lenders from using medical bills in credit decisions and prohibits credit bureaus from including medical debt on reports furnished to lenders, removing roughly $49 billion in medical debts from the credit files of 15 million Americans.
- Accurate medical billing compliance: Errors or premature referrals can trigger consumer complaints or enforcement actions under both HIPAA and the Fair Debt Collection Practices Act (FDCPA).
- Liability through vendors: A collection agency violation of HIPAA can expose the originating provider if the agency mishandles PHI or lacks proper security protocols.
These laws protect patients from coercive debt collection tactics and ensure providers maintain ethical, transparent billing practices.
The Federal Legal Framework for Medical Debt Collection
HIPAA and Its Role in Collections
HIPAA (Health Insurance Portability and Accountability Act) is the cornerstone of privacy protection in healthcare. It governs how patient information can be used or disclosed—even for collections.
According to the U.S. Department of Health and Human Services (HHS), HIPAA allows providers to share PHI for “payment” purposes, which explicitly includes collection activities under Section 164.506(a). Disclosures for treatment, payment, and healthcare operations do not require patient authorization.
However, providers must meet key conditions:
- Share only the minimum necessary information, such as name, amount owed, service date, and account details. Clinical notes or diagnoses should never be included.
- Execute a Business Associate Agreement (BAA) with any third-party agency that handles PHI on the provider’s behalf.
- Ensure the agency’s data systems comply with HIPAA Security Rule standards for encryption, access controls, and breach response.
- Audit collection vendors regularly to verify ongoing compliance.
Failure to limit PHI exposure can result in severe penalties for both the provider and the collection agency.
In short: HIPAA doesn’t prohibit medical debt collection—it defines how it must be done.
Other Federal Medical Debt Laws
Two additional federal laws shape the collections landscape:
- Fair Debt Collection Practices Act (FDCPA): Enforced by the Federal Trade Commission (FTC), this act prohibits harassment, false statements, or deceptive communication by debt collectors. While it applies mainly to third-party agencies rather than providers themselves, providers remain accountable for the behavior of their contractors.
- Fair Credit Reporting Act (FCRA): Also overseen by the FTC, the FCRA governs how debt information is reported to consumer reporting agencies. Historically, medical collections could appear on credit reports, but that changed under the CFPB’s 2025 Regulation V amendment, which now bans lenders from using medical debt information and prohibits credit bureaus from including medical bills on reports used for lending.
Medical Billing Compliance Before Collections
Even before a medical bill is sent to collections, proper medical billing compliance is essential. Most compliance failures originate long before a debt reaches an external agency.
1. Accurate, Transparent Billing
Every statement should reflect verified charges, insurance adjustments, and clear patient responsibility. Inaccuracies or unclear bills are the leading cause of disputed medical debts.
2. Financial Assistance and Documentation
Hospitals and certain clinics must comply with federal requirements—such as the Affordable Care Act’s § 501(r) provisions—to offer financial assistance policies. Providers should document outreach efforts, payment plans, or charity care eligibility before transferring an account to collections.
3. Effective Communication
Regular, respectful communication improves patient satisfaction and payment rates. Providers should issue multiple notices, allow reasonable grace periods, and inform patients of possible collection referral in advance. These steps demonstrate good faith and support compliance with both federal and state medical debt laws.
4. Complete Documentation for Referral
Before referring a debt, maintain records including:
- Dates of service and amount owed
- Proof of insurance claim resolution
- Copies of billing statements and patient communications
- Payment-plan offers or financial assistance documentation
- Internal collection notes
This documentation protects providers from disputes and shows regulators that all reasonable collection efforts were made internally first.
How Healthcare Collection Services Stay Compliant
A compliant healthcare collection service operates within strict privacy and consumer-protection boundaries. Key safeguards include:
- Minimum-necessary disclosure: Limit PHI shared to essential payment details.
- HIPAA-compliant systems: Encryption, audit trails, and breach-notification procedures are mandatory.
- FDCPA training: Collectors must understand and comply with federal and state limits on communication frequency, call times, and debt validation requirements.
- FCRA awareness: Even though medical debts can’t be reported to lenders, agencies must ensure any remaining reporting activity (such as non-lender credit data) follows the Fair Credit Reporting Act.
- State-law compliance: Many states impose additional rules on timing, notices, and consumer protections in medical debt collection.
Providers should verify that their vendors have up-to-date compliance programs and written policies covering these areas. Because HIPAA treats vendors as “business associates,” a provider can still be liable for violations committed by its contractors.
Protecting Patients and Your Practice
Medical debt collection laws have never been more intricate—or more important. HIPAA dictates how and when PHI can be shared, the FDCPA controls how collectors interact with patients, and the CFPB’s 2025 rule reshapes how medical debts affect credit. Together, these frameworks emphasize fairness, transparency, and privacy in healthcare billing.
Providers who master medical billing compliance and partner with trustworthy, HIPAA-compliant healthcare collection services can improve their revenue cycle without risking violations. Avoiding violation of HIPAA isn’t just a legal duty—it’s a matter of professional integrity and patient trust.
If your organization needs help navigating complex medical debt regulations, partner with our experienced collection agency. CRS specializes in compliant medical billing collections, ensuring full adherence to HIPAA, FDCPA, and CFPB standards—so you can focus on patient care while we protect your revenue and your reputation.
Contact us today to get started.
