Selling medical debt is not automatically a HIPAA violation, but it can become one depending on how the debt collector handles your health information

When a hospital or doctor's office sells your unpaid medical bill to a debt collector, they are allowed to do it under federal law. The sale itself — transferring the debt from one company to another — does not break HIPAA. What matters is whether your protected health information travels with that debt, and if it does, whether the buyer agreed to keep it confidential.

The key distinction: HIPAA protects your health information (diagnoses, treatment details, medication names), not the fact that you owe money for medical care. A debt collector can legally know you have an unpaid hospital bill. They cannot legally receive your medical records unless specific rules are followed.

In practice, most medical debt sales happen without detailed health records attached. The debt collector gets your name, the amount owed, the date of service, and the provider's name — not your diagnosis or treatment plan. But if health details do cross over, the original provider must have a written agreement in place, called a Business Associate Agreement, that binds the debt collector to HIPAA rules.

Key Takeaways

  • Selling medical debt itself is legal; HIPAA violations occur only when protected health information is shared without proper safeguards.
  • Most debt sales include only the amount owed and dates, not your diagnosis or medical details, so HIPAA often does not apply to the transaction.
  • If your medical records or diagnosis information does transfer to a debt collector, the original provider must have a signed Business Associate Agreement in place first.
  • A debt collector who receives health information and violates HIPAA can be reported to the Office for Civil Rights, which investigates complaints.
  • Debt collection calls and letters about medical debt are regulated by the Fair Debt Collection Practices Act, which has separate rules from HIPAA.

What information actually moves when debt is sold

When a medical provider sells your debt, the debt collector typically receives a list with your name, address, phone number, the amount owed, and the date the service was provided. They do not automatically receive your medical record, your diagnosis, or details about what procedure or treatment you had.

Some providers do include a brief description of the service — "emergency room visit" or "lab work" — but this is not the same as sharing your full medical information. A description of the type of service is not protected health information under HIPAA; your specific diagnosis and treatment details are.

However, if a provider sells debt and includes your actual medical records, your diagnosis, or your treatment plan, that is when HIPAA rules kick in. The provider must have already signed a Business Associate Agreement with the debt collector before sending any of that information. Without that agreement in writing, sharing detailed health information is a HIPAA violation.

Business Associate Agreements and what they require

A Business Associate Agreement is a legal contract that says the debt collector will treat your health information the same way the original provider does — keeping it confidential, using it only to collect the debt, and protecting it from unauthorized access. If a provider shares health information with a debt collector without this agreement in place, that is a HIPAA violation on the provider's side.

The agreement must specify what information the debt collector can receive, how long they can keep it, and what they must do when the debt is paid or the case is closed. It also requires the debt collector to report any data breaches to the provider, who then reports to you.

Not all debt collectors have Business Associate Agreements with medical providers. Many operate under the assumption that they will not receive detailed health information, so they never sign one. If a provider tries to send health records to a debt collector who has not signed an agreement, the debt collector should refuse to accept them, or the provider is breaking HIPAA.

When a debt collector violates HIPAA with your information

A HIPAA violation by a debt collector can happen in several ways. They might disclose your health information to a third party without permission — for example, mentioning your diagnosis to a family member who calls about your account. They might fail to secure your records properly, leading to a data breach. Or they might use your health information for purposes beyond debt collection, such as selling it to a marketing company.

If you believe a debt collector has violated HIPAA, you can file a complaint with the Office for Civil Rights, which is part of the U.S. Department of Health and Human Services. You have 180 days from the date you discovered the violation to file. The OCR will investigate whether the debt collector had a Business Associate Agreement, whether they followed it, and whether your health information was mishandled.

Complaints can be filed online at the OCR website or by mail. You will need to describe what happened, when it happened, and what health information was involved. The OCR does not charge a fee and does not require you to hire a lawyer.

Debt collection calls and HIPAA are separate issues

A debt collector calling you about medical debt is not a HIPAA violation just because they mention the debt. HIPAA does not prevent a debt collector from contacting you about money you owe. What HIPAA prevents is them sharing your health details with others or misusing the information they have.

However, debt collection calls are regulated by the Fair Debt Collection Practices Act, a different federal law. Under the FDCPA, a debt collector cannot call you before 8 a.m. or after 9 p.m., cannot call your workplace if your employer objects, cannot harass you, and cannot disclose your debt to third parties like your employer or neighbors. If a debt collector violates the FDCPA, you can sue them in small claims court or file a complaint with the Consumer Financial Protection Bureau.

A single call or letter about medical debt usually does not violate either law. But repeated calls, calls to your workplace, or calls that mention your diagnosis to someone else would raise red flags under FDCPA and possibly HIPAA.

Your rights if you discover a HIPAA violation

If a debt collector or medical provider shares your health information without permission or without a proper Business Associate Agreement, you have the right to know what happened. You can request a copy of your medical record from the provider and ask them to explain what information was shared and with whom.

You can also request an accounting of disclosures, which is a list of everyone the provider has shared your health information with in the past six years. This request must be honored within 30 days, though the provider can extend it by another 30 days if needed.

If you find that information was shared improperly, document everything — dates, names of people who called, what was said — and file a complaint with the OCR. You can also contact your state's attorney general's office, which may have additional consumer protection laws on top of HIPAA.

How to protect yourself when medical debt is sold

When you receive a call or letter from a debt collector about medical debt, you have the right to request written verification of the debt within 30 days. This is required under the FDCPA. Ask them to confirm the amount, the original provider, and the date of service.

You can also send a written request asking what health information they received and whether they have a Business Associate Agreement with the original provider. Keep copies of all correspondence. If they refuse to answer or if their answers do not match what you know to be true, that is a sign to escalate the issue.

If you are concerned about your privacy, you can contact the original medical provider and ask whether they sold your debt and what information was included in the sale. Providers are required to tell you this if you ask. You can also ask the provider to place a restriction on your record, limiting what information can be shared in the future — though the provider can refuse if the restriction would interfere with treatment or payment.

Frequently Asked Questions

Can a debt collector mention my diagnosis when they call?

Not to anyone but you. If a debt collector received your diagnosis as part of a Business Associate Agreement, they can discuss it with you to collect the debt. They cannot mention it to your family, employer, or anyone else. Doing so would be a HIPAA violation. If this happens, document the call and file a complaint with the Office for Civil Rights.

What if the debt collector says they got my information from a credit bureau, not the hospital?

Credit bureaus do not typically receive detailed health information from hospitals. They receive the fact that a debt exists and basic details like the amount and date. If a debt collector is using information from a credit bureau, HIPAA does not apply to that transaction because no health information was shared. However, the credit bureau's handling of your information is regulated by the Fair Credit Reporting Act.

Does HIPAA stop a provider from selling my debt at all?

No. HIPAA does not prohibit medical providers from selling debt. It only regulates how health information can be shared during that sale. A provider can sell your unpaid bill to a debt collector without violating HIPAA as long as they do not share your medical records or diagnosis without a Business Associate Agreement in place.

Can I sue a debt collector for a HIPAA violation?

You cannot sue directly under HIPAA, but you can file a complaint with the Office for Civil Rights, which can investigate and impose penalties. You may also have a claim under state privacy laws or under the Fair Debt Collection Practices Act if the debt collector's conduct violated that law. Consult a lawyer in your state to understand your options.

How long does an OCR investigation take?

The Office for Civil Rights typically takes several months to investigate a HIPAA complaint, though the timeline varies depending on the complexity of the case and the number of complaints they are handling. You will be notified of the outcome, but the investigation is not always public. If the OCR finds a violation, they can require the organization to pay damages or change their practices.