// 04 — use HIPAA to challenge collections

HIPAA REMOVAL

// hipaa removal strategy

The HIPAA removal method.

HIPAA governs how healthcare providers share your medical information. If a provider sent your information to a collection agency without proper authorization, you can leverage this to challenge the collection.

The process (5 steps)

  1. Pay the original provider directly. Contact the hospital or doctor and pay the original bill — not the collection agency. Get a receipt.
  2. Request a HIPAA validation letter. Ask the collection agency to prove legal authorization to collect and that the provider shared your information in compliance with HIPAA.
  3. File a HIPAA complaint with HHS OCR. If the agency cannot produce authorization documentation, file at hhs.gov/ocr.
  4. Dispute with the credit bureaus. Cite the HIPAA violation. The bureau must verify — and if the agency is under investigation, they often cannot.
  5. Follow up with method-of-verification. If the bureau verifies, demand to know how. Many use automated e-OSCAR, which is insufficient.

HIPAA Validation Letter Template

[YOUR NAME] [YOUR ADDRESS] [YOUR CITY, STATE ZIP] [DATE] [COLLECTION AGENCY NAME] [COLLECTION AGENCY ADDRESS] RE: Request for HIPAA Authorization Documentation Account: [ACCOUNT NUMBER] Original Creditor: [HEALTHCARE PROVIDER NAME] To Whom It May Concern, I am requesting documentation demonstrating that you have valid authorization to collect on the above-referenced medical debt, and that the original creditor disclosed my protected health information to you in compliance with the HIPAA Privacy Rule (45 CFR 164.502 and 164.508). Specifically, I am requesting: 1. A copy of the authorization form signed by me permitting disclosure to your agency. 2. Documentation of your Business Associate Agreement with the original provider. 3. Proof that you have a legal right to collect this debt. If you cannot provide this documentation within 30 days, I request that you cease all collection activity and remove this account from all credit reporting agencies. Sincerely, [YOUR NAME]

Important notes

  • Pay the original provider — never the collection agency
  • Get a receipt showing the debt is paid at the source
  • File the HHS complaint at hhs.gov/ocr/privacy/hipaa/complaints
  • This method is for unpaid medical collections only
  • If the collection is under $500, it should not appear at all