Selling medical debt is not itself a HIPAA violation, but the way it is sold must follow HIPAA rules
A hospital or debt collector can sell your medical debt to another company without breaking HIPAA law. What they cannot do is sell or share the health information attached to that debt — your diagnosis, treatment details, medication list, or any other medical record. The debt itself (the dollar amount you owe, the dates of service, which provider treated you) can change hands. The medical facts behind it cannot.
This distinction matters because many people assume that once debt is sold, their medical privacy is gone. It is not. HIPAA still applies to whoever buys the debt, and it still applies to the original provider who sold it. Both are bound by the same privacy rules.
The real risk is not the sale itself but what information gets packaged with the sale, and whether the buyer follows HIPAA after they own it. A debt collector who receives your file and then uses your diagnosis to pressure you into paying faster, or who shares your medical details with a third party, has crossed the line.
Key Takeaways
- Hospitals and debt collectors can sell medical debt to another company without violating HIPAA, as long as they do not include protected health information in the sale.
- HIPAA applies to the buyer of the debt just as it applied to the original provider, so the new owner must also keep your medical details private.
- A debt collector who uses your diagnosis or medical history to pressure you into payment, or who shares those details with others, is breaking HIPAA.
- If you believe your medical information was shared improperly during a debt sale, you can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.
What information can and cannot be sold with medical debt
When a hospital sells your debt, it can transfer the basic facts: your name, address, the amount owed, the date of service, and the name of the provider. It can also share the fact that you received treatment at a particular facility. These details are not protected health information under HIPAA because they do not reveal anything about your condition or care.
What cannot be sold or transferred is your diagnosis, test results, medication names, treatment plans, provider notes, or any other detail from your medical record. If a debt collector receives a file that includes "Patient owes $3,000 for emergency room visit on March 15" that is legal. If the file says "Patient owes $3,000 for emergency room visit on March 15 for treatment of pneumonia" that crosses into protected information and should not have been included.
In practice, many debt files do include some medical detail — the type of service (surgery, imaging, lab work) or the department (oncology, cardiology). Whether this crosses the HIPAA line depends on how specific it is and whether it reveals the patient's condition. A debt collector receiving a file that says "radiology services" is different from one that says "breast cancer screening." The second one reveals a diagnosis.
How HIPAA protects you after the debt is sold
Once a debt collector owns your medical debt, HIPAA applies to them just as it applied to the original hospital. They must keep your medical information confidential, use it only for the purpose of collecting the debt, and not disclose it to anyone else without your permission or a legal reason.
This means a debt collector cannot tell your employer, family member, or another creditor about your medical condition. They cannot post your diagnosis on a credit report. They cannot use your medical history as leverage in collection calls — for example, saying "we know you have diabetes, so you should prioritize this bill." They cannot sell your medical information to a third party, even if they sell the debt itself.
If a debt collector violates these rules, they are breaking HIPAA, not just debt collection law. The violation can be reported to the Office for Civil Rights at the U.S. Department of Health and Human Services, which investigates HIPAA complaints and can impose penalties.
The difference between debt sale and medical record sale
It is important to separate two different transactions. One is the sale of the debt itself — the right to collect money from you. The other is the sale of medical records or health information. These are governed by different laws and have different rules.
A hospital can sell your debt without selling your medical records. It can also, in some cases, sell your medical records separately — but only if you have signed a consent form allowing it, or if there is a legal reason (like a court order). straightforward owing money does not give a hospital the right to sell your medical information.
Some debt buyers do request medical records from the original provider as part of their collection work, but they must request them through proper channels and the provider must verify that the request is legitimate before releasing them. A debt collector cannot straightforward demand your full medical file along with the debt.
What to do if you think your medical privacy was violated
If a debt collector has used your medical information improperly — by sharing it, using it to pressure you, or including it in communications with others — you have the right to report it. Start by asking the debt collector in writing to stop the violation and to confirm what medical information they have about you.
If they do not respond or continue the violation, file a complaint with the Office for Civil Rights. You can submit a complaint online at the HHS website, by mail, or by phone. Include details about what information was shared, who it was shared with, and when it happened. The OCR will investigate and can require the debt collector to delete the information, change their practices, or pay a penalty.
You can also file a complaint with your state's attorney general or with the Consumer Financial Protection Bureau if the debt collector is also violating debt collection laws — for example, by harassing you or making false statements about the debt.
How to limit what information is shared when debt is sold
You cannot stop a hospital from selling your debt, but you can limit what information goes with it. When you receive a bill or debt notice, look for contact information for the billing department or patient advocate. Call and ask what information will be included if the debt is sold. Request in writing that only the minimum necessary information be transferred — the amount owed, dates of service, and your contact details.
This request does not have legal force, but it creates a record. If the hospital later sells the debt with excessive medical detail, you have documentation that you objected. This can strengthen a HIPAA complaint.
You can also request a copy of your medical record from the hospital to see exactly what information exists about your care. Under HIPAA, you have the right to see your own record. Knowing what is in the file helps you spot if something was shared improperly later.
Frequently Asked Questions
Can a debt collector use my diagnosis to convince me to pay?
No. Using your medical information as leverage in collection calls or letters is a HIPAA violation. A debt collector can pressure you to pay the debt itself, but cannot reference your condition, treatment, or medical history to do so. If this happens, document the call or letter and report it to the Office for Civil Rights.
If my debt is sold, will my credit report show my diagnosis?
No. Credit reports cannot include medical information under federal law. A debt will appear on your credit report as a collection account, but the reason for the debt (your diagnosis or treatment) should not be listed. If you see medical details on your credit report, dispute them with the credit bureau.
Can a hospital sell my medical records to a debt collector without my permission?
No. Selling medical records is different from selling debt. A hospital can sell the debt without your permission, but selling your actual medical records requires your written consent or a legal order. A debt collector can request records from the hospital, but the hospital must verify the request is legitimate before releasing them.
What if the debt collector says they need my medical information to verify the debt?
They may need some information — the date of service, the provider's name, the type of service — to confirm the debt is yours. But they should not need your diagnosis, treatment details, or medication list. If they ask for extensive medical information, ask in writing what specific information they need and why. You can also ask them to work directly with the original provider instead of requesting information from you.
Where do I report a HIPAA violation by a debt collector?
File a complaint with the Office for Civil Rights at the U.S. Department of Health and Human Services. You can submit online at hhs.gov/ocr, by mail to the regional OCR office that covers your state, or by phone. Include details about what happened, when, and what information was misused. The OCR investigates and can impose penalties on the debt collector.