Published by Professional Mitigation Services
Updated: May 2026 Category: Healthcare Debt Recovery
Reading Time: ~9 minutes
Table of Contents
- Introduction: The Hidden Revenue Problem in Healthcare
- What Is a Medical Debt Collection Agency?
- HIPAA Requirements in Medical Collections
- FDCPA Rules for Medical Accounts
- Why In-House Medical Collections Fail
- How Professional Mitigation Services Handles Medical Accounts
- Frequently Asked Questions
- Conclusion & Call to Action
If you run a medical practice, a hospital outpatient clinic, or any healthcare facility, you already know this truth — delivering excellent care is only half the battle. Getting paid for it is the other half.
According to the American Hospital Association, U.S. hospitals and health systems provided more than $745 billion in total uncompensated care over the last decade. For individual practices, the numbers are smaller but the pain is the same. Unpaid patient balances quietly drain cash flow, consume staff time, and — if handled incorrectly — expose your organization to serious legal liability.
The challenge is that medical debt recovery is not like collecting on a standard commercial invoice. It sits at the crossroads of two powerful federal laws: the Health Insurance Portability and Accountability Act (HIPAA) and the Fair Debt Collection Practices Act (FDCPA). Get either one wrong and you are not just failing to collect — you are opening your practice to regulatory penalties, lawsuits, and reputational damage.
In this guide, we break down exactly what healthcare providers need to know about HIPAA-compliant collections, how the FDCPA applies to medical accounts, why most in-house collection efforts quietly fail, and how working with a professional medical debt collection agency like Professional Mitigation Services (PMS) changes the outcome.
Whether you are a solo practitioner, a multi-location group practice, or a healthcare billing manager, this guide gives you practical, actionable knowledge to protect your revenue and your compliance standing.
2. What Is a Medical Debt Collection Agency?
A medical debt collection agency is a third-party firm that recovers unpaid patient balances on behalf of healthcare providers. Unlike general commercial debt collectors, a qualified medical collections agency understands the unique regulatory environment that governs patient financial data — specifically HIPAA and the FDCPA.
A reputable agency in this space will:
- Operate under a formal Business Associate Agreement (BAA) with your practice
- Handle Protected Health Information (PHI) in strict compliance with HIPAA
- Conduct all patient outreach in full compliance with the FDCPA
- Maintain secure, encrypted data handling protocols
- Report to credit bureaus only when legally permitted and procedurally correct
- Provide transparent, documented reporting on every account
Not every debt collection agency is equipped to handle medical accounts correctly. Choosing the wrong partner is not just inefficient — it can result in HIPAA violations that carry fines ranging from $100 to $50,000 per violation, per category, per year.
3. HIPAA Requirements in Medical Collections
HIPAA is the foundational law governing the privacy and security of patient health information in the United States. When a healthcare provider hands an unpaid account to a collection agency, they are sharing Protected Health Information (PHI) — which means HIPAA’s rules apply directly to that relationship.
What Counts as PHI in a Collections Context?
When you refer a patient account to a collection agency, the information you share typically includes the patient’s name, address, date of birth, Social Security number, the name of the healthcare provider, the date of service, and the amount owed. All of this qualifies as PHI under HIPAA and must be handled accordingly.
The Business Associate Agreement (BAA)
Before sharing any patient data with a collection agency, you are legally required to have a signed Business Associate Agreement in place. The BAA is a formal contract that:
- Designates the collection agency as a Business Associate under HIPAA
- Specifies how the agency is permitted to use and disclose PHI
- Requires the agency to implement appropriate safeguards for patient data
- Obligates the agency to report any data breaches to your practice
- Confirms the agency will not use PHI for any purpose beyond debt recovery
Running collections without a BAA is a direct HIPAA violation — and the Office for Civil Rights (OCR), which enforces HIPAA, does investigate and fine healthcare providers and their business associates for this exact failure.
Minimum Necessary Standard
HIPAA’s Minimum Necessary Rule requires that only the information actually needed to perform the collection function is shared. Your collection agency does not need your patient’s full medical records, diagnosis codes, or clinical notes. They need the billing data required to contact and collect from the patient. A compliant agency will understand and enforce this standard on their end.
Security Safeguards
Any agency handling medical debt accounts must implement:
- Administrative safeguards (written privacy policies, staff training)
- Physical safeguards (secure storage of any physical records)
- Technical safeguards (encrypted data transmission, secure access controls)
When evaluating a medical debt collection agency, ask directly about their HIPAA compliance program, their data security protocols, and whether they have experienced any reportable breaches. A professional agency will answer these questions without hesitation.
4. FDCPA Rules for Medical Accounts
The Fair Debt Collection Practices Act governs how third-party debt collectors may communicate with consumers — including patients — when attempting to recover a debt. Medical accounts are explicitly subject to the FDCPA when collected by a third-party agency.
Core FDCPA Protections That Apply to Patients
Every patient whose balance has been referred to a collection agency retains these federal rights:
- The right to receive a written validation notice within five days of first contact, stating the amount owed, the name of the creditor, and their right to dispute the debt
- The right to dispute the debt in writing within 30 days of receiving the validation notice
- The right to be free from harassment, threats, or abusive language
- The right to request that the collector cease contact
- The right to communicate only through an attorney if they have retained one
- The right to not be called before 8:00 a.m. or after 9:00 p.m. local time
- The right to not be contacted at their place of work if the collector has reason to know it is not permitted
What This Means for Healthcare Providers
As the original creditor, your practice is not directly subject to the FDCPA — but your collection agency is. If the agency you hire violates the FDCPA when collecting on your behalf, your practice can face reputational harm and, in some cases, legal exposure depending on the agency relationship structure.
This is why vetting your collection partner’s FDCPA compliance record is not optional. Ask whether they have faced FDCPA lawsuits. Ask how they document communications. Ask what training their collectors receive.
The 2021 Debt Collection Final Rule (Reg F)
The Consumer Financial Protection Bureau’s Regulation F, which took full effect in late 2021, modernized the FDCPA for the digital age. Key updates that directly affect medical collections include:
- Collectors may now contact consumers by email and text message under specific opt-in and consent conditions
- A seven-contact-in-seven-days limit applies per debt
- Enhanced disclosure requirements for time-barred debts
- Restrictions on collecting debts that a collector knows are past the statute of limitations without proper disclosure
A professional medical debt collection agency will have already updated its procedures and scripts to reflect Reg F compliance. If your current or prospective agency has not, that is a significant red flag.
5. Why In-House Medical Collections Fail
Many healthcare practices begin with the best intentions: assign billing staff to follow up on aged receivables, send a few statements, and escalate to a supervisor when patients don’t respond. In practice, this approach consistently underperforms — and here’s why.
Staff Are Not Trained Debt Collectors
Your front desk staff and billing department are skilled at processing claims, verifying insurance, and coding procedures. They are not trained in professional debt recovery, negotiation psychology, or FDCPA compliance. Asking them to collect past-due balances is asking them to do a job they were not hired, trained, or equipped to perform.
FDCPA Liability Falls on Your Practice
When your employees collect from patients, your practice assumes direct liability for every interaction. A single improperly worded call — one that could be characterized as harassment or a misrepresentation — can result in an FDCPA lawsuit against your organization. The average FDCPA settlement is not large individually, but class actions and patterns of violations are extremely costly.
It Consumes Time That Should Go to Patient Care
Every hour a billing manager spends chasing a $300 balance is an hour not spent on claim submission, authorization processing, or denial management — functions with far greater revenue impact. The opportunity cost of in-house collections is rarely calculated, but it is real and substantial.
Collection Rates on Aged Accounts Drop Sharply
Industry data is consistent: the older an account, the harder it is to collect. Accounts receivable that sit unpursued past 90 days recover at significantly lower rates than accounts worked aggressively from 30 days. Most in-house teams lack the bandwidth to pursue accounts with the frequency and strategy required before they age past recoverable thresholds.
No Credit Bureau Leverage
In-house collectors cannot report to credit bureaus. This removes one of the most effective motivators for patient payment. Third-party agencies that are licensed data furnishers — like Professional Mitigation Services — can report delinquent accounts to the major credit bureaus, which creates meaningful incentive for resolution.
No Legal Escalation Path
When a patient simply refuses to pay, in-house teams have limited options. A professional agency with an established legal forwarding network can escalate accounts to licensed attorneys in the patient’s jurisdiction — without the provider having to separately retain counsel.
6. How Professional Mitigation Services Handles Medical Accounts
Professional Mitigation Services is a nationally licensed, FDCPA-compliant debt collection agency with a dedicated program for healthcare debt recovery. Here is exactly how PMS approaches medical collections differently.
HIPAA-Aware Operations from Day One
PMS executes a formal Business Associate Agreement with every healthcare client before a single account is processed. Patient data is handled under strict access controls, with encrypted transmission and documented data handling protocols that meet HIPAA’s administrative, physical, and technical safeguard requirements.
Only the minimum necessary PHI required for recovery is accessed and used. PMS staff who handle medical accounts receive specific HIPAA training in addition to FDCPA compliance training.
Contingency-Based — No Upfront Cost
PMS operates on a contingency fee model: no recovery, no fee. Healthcare providers pay nothing unless funds are successfully collected. This eliminates the financial risk of outsourcing collections and aligns PMS’s incentives directly with yours.
Professional, Non-Aggressive Patient Contact
PMS understands that patients are also your future customers. Collection efforts are conducted professionally and without the aggressive or harassing tactics that can permanently damage a provider’s reputation. The goal is resolution — not confrontation.
Every communication is FDCPA-compliant, properly documented, and tracked. Patients receive their full legal rights disclosures. Disputes are handled promptly and in accordance with federal law.
Licensed Data Furnisher — Credit Bureau Reporting
PMS is a licensed data furnisher, meaning it can report qualifying delinquent medical accounts to the major credit bureaus. This is a powerful recovery tool that in-house teams simply do not have access to. Note: PMS applies this tool selectively and in compliance with applicable law, including any jurisdiction-specific restrictions on medical debt credit reporting.
Legal Forwarding When Necessary
When standard recovery efforts are exhausted, PMS can escalate accounts to its vetted nationwide legal forwarding network — licensed attorneys in the debtor’s jurisdiction who can pursue legal remedies including judgment and garnishment when warranted. Healthcare providers never need to source separate legal counsel.
15-Day Remittance
Funds recovered are remitted to your practice within 15 days of clearing PMS’s trust account. You are not waiting indefinitely for money that has already been collected.
Regular Reporting and Transparency
You have full visibility into the status of your accounts. PMS provides regular recovery reporting so healthcare providers always know what has been collected, what is in progress, and what has been escalated.
7. Frequently Asked Questions
Q1: Does my practice need a Business Associate Agreement with every collection agency we use?
Yes. Any third-party vendor that receives, processes, or accesses Protected Health Information on behalf of your practice must have a signed BAA in place before work begins. This is a direct HIPAA requirement. Failure to have a BAA with your collection agency is a reportable violation. Professional Mitigation Services provides and executes a BAA with all healthcare clients as a standard first step.
Q2: Can a collection agency legally report medical debt to the credit bureaus?
Yes, under federal law, medical debt may be reported to credit bureaus by licensed data furnishers. However, the credit reporting landscape for medical debt has been evolving. As of 2024–2025, the major credit bureaus — Equifax, Experian, and TransUnion — have voluntarily removed medical debt under $500 from credit reports, and paid medical debts are no longer reported. Additionally, a final rule proposed by the CFPB in 2025 aimed to prohibit most medical debt from credit reports entirely, though its implementation status should be verified with current regulatory guidance. PMS applies credit reporting practices in full compliance with the most current applicable laws and bureau policies.
Q3: What is the FDCPA validation notice and how does it affect medical collections?
The FDCPA requires a third-party debt collector to send a written validation notice to the consumer within five days of the first communication. This notice must state the amount of the debt, the name of the creditor to whom the debt is owed, and the consumer’s right to dispute the debt within 30 days. For medical accounts, the creditor listed is the healthcare provider. If the patient submits a written dispute within that 30-day window, the collector must cease collection activity and verify the debt before proceeding. PMS manages this process correctly and completely on every account.
Q4: How soon after a patient balance becomes past due should we refer it to collections?
Industry experience consistently shows that accounts referred for collection earlier in the delinquency cycle recover at significantly higher rates. Accounts under 90 days old typically recover at the highest rates. By 180 days, recovery rates decline meaningfully. Most healthcare billing consultants recommend a structured escalation pathway: statement reminders at 30 and 60 days, a final in-house demand at 90 days, and referral to a professional collection agency at 90–120 days if the balance remains unresolved. PMS also offers pre-collection demand letters for accounts not yet ready for full collections.
Q5: What happens if a patient claims they never received a bill and disputes the debt?
This is a common scenario in medical collections. Under the FDCPA, when a patient submits a written dispute within 30 days of the first collection notice, PMS must pause collection activity and provide verification of the debt — which typically means providing documentation from the healthcare provider confirming the service date, amount, and the patient’s identity. PMS handles the dispute process fully and works with your billing department to obtain the necessary verification documentation. The account is not abandoned on dispute — it is properly documented, verified, and then returned to the collection process with full legal protection.
8. Conclusion: Protecting Your Revenue and Your Compliance
Medical debt recovery is one of the most legally complex areas of collections. Between HIPAA’s patient privacy requirements, the FDCPA’s consumer protection framework, evolving credit bureau policies, and the practical challenge of recovering aging balances — healthcare providers face a genuinely difficult environment when trying to bring in the revenue they are owed.
The takeaways from this guide are clear:
- HIPAA compliance in collections is non-negotiable. A BAA is required. Data handling standards must be met. Minimum necessary PHI must be enforced.
- The FDCPA applies fully to medical accounts. Patients have strong federal rights, and violation exposure belongs to the agency you hire.
- In-house collections consistently underperform due to inadequate training, legal exposure, and the absence of tools like credit bureau reporting and legal forwarding.
- Working with a professional, HIPAA-aware, FDCPA-compliant medical debt collection agency is the highest-ROI path for healthcare providers who want to recover more, protect their compliance standing, and stay focused on patient care.
Professional Mitigation Services is built for exactly this challenge. We operate under formal BAAs, with rigorous HIPAA and FDCPA compliance protocols, a contingency-based fee structure, licensed data furnisher status, nationwide legal forwarding capabilities, and 15-day remittance.
Ready to Recover What Your Practice Is Owed?
Every day an unpaid patient balance sits unresolved is money that should be in your practice’s account. PMS acts fast, operates with integrity, and specializes in the compliance requirements that make medical debt recovery uniquely complex.
Book your Free Discovery Call today — no obligation, no upfront cost. Tell us about your outstanding accounts and we will tell you exactly what we can recover.
👉 Book Your Free Discovery Call at www.professionalmitigationservices.com/contact/
📞 Or call us directly: (954) 480-1851
📧 support@professionalmitigationservices.com
No Recovery. No Fee. No Risk. Professional Mitigation Services — National Medical Debt Collection Agency | HIPAA-Aware | FDCPA Compliant | Licensed Data Furnisher
Author: Professional Mitigation Services Editorial Team. Professional Mitigation Services, Inc. is a nationally licensed commercial and medical debt collection agency headquartered in Sunrise, FL, with offices across South Florida. PMS serves healthcare providers, businesses, and attorneys across all 50 states with FDCPA-compliant, results-driven debt recovery.
Last Updated: May 2026