HIPAA governs how healthcare providers share your medical information. If a provider sent your information to a collection agency without proper authorization, you can leverage this to challenge the collection.
The process (5 steps)
Pay the original provider directly. Contact the hospital or doctor and pay the original bill — not the collection agency. Get a receipt.
Request a HIPAA validation letter. Ask the collection agency to prove legal authorization to collect and that the provider shared your information in compliance with HIPAA.
File a HIPAA complaint with HHS OCR. If the agency cannot produce authorization documentation, file at hhs.gov/ocr.
Dispute with the credit bureaus. Cite the HIPAA violation. The bureau must verify — and if the agency is under investigation, they often cannot.
Follow up with method-of-verification. If the bureau verifies, demand to know how. Many use automated e-OSCAR, which is insufficient.
HIPAA Validation Letter Template
[YOUR NAME]
[YOUR ADDRESS]
[YOUR CITY, STATE ZIP]
[DATE]
[COLLECTION AGENCY NAME]
[COLLECTION AGENCY ADDRESS]
RE: Request for HIPAA Authorization Documentation
Account: [ACCOUNT NUMBER]
Original Creditor: [HEALTHCARE PROVIDER NAME]
To Whom It May Concern,
I am requesting documentation demonstrating that you
have valid authorization to collect on the above-referenced
medical debt, and that the original creditor disclosed my
protected health information to you in compliance with
the HIPAA Privacy Rule (45 CFR 164.502 and 164.508).
Specifically, I am requesting:
1. A copy of the authorization form signed by me
permitting disclosure to your agency.
2. Documentation of your Business Associate Agreement
with the original provider.
3. Proof that you have a legal right to collect this debt.
If you cannot provide this documentation within 30 days,
I request that you cease all collection activity and remove
this account from all credit reporting agencies.
Sincerely,
[YOUR NAME]
Important notes
Pay the original provider — never the collection agency
Get a receipt showing the debt is paid at the source
File the HHS complaint at hhs.gov/ocr/privacy/hipaa/complaints
This method is for unpaid medical collections only
If the collection is under $500, it should not appear at all