FDCPA and Medical Debt: What Healthcare Providers Need to Know

Medical debt is the most common type of debt in collections in the United States and one of the most heavily scrutinized. The Kaiser Family Foundation estimates that Americans owe roughly $220 billion in medical debt. For hospitals, physician groups, labs, and other healthcare organizations, that balance sheet reality collides with a dense web of federal and state rules.

At the center of that web sits the Fair Debt Collection Practices Act (FDCPA) and its implementing rule, Regulation F. Understanding how FDCPA medical debt rules work, who they apply to, and where they intersect with credit reporting and billing laws is now a core part of revenue cycle management. A single noncompliant letter or phone call can trigger statutory damages, class action exposure, and reputational harm with the very patients you serve.

This guide explains what healthcare providers need to know about FDCPA medical debt compliance in 2026, including recent regulatory shifts, the medical debt collection laws that sit alongside the FDCPA, and practical steps to build a defensible healthcare collection compliance program.

Does the FDCPA Apply to Healthcare Providers?

In most cases, the FDCPA does not directly apply to a healthcare provider collecting its own patient balances. The statute regulates “debt collectors,” meaning third parties who regularly collect debts owed to someone else, or whose principal business is debt collection. A hospital billing office sending statements for its own services is generally a first-party creditor, not a debt collector.

That exemption is narrower than many providers assume. Your organization can fall under FDCPA medical debt rules in several situations:

• The false-name exception. If you collect your own accounts using a name that suggests a third party is involved, such as a fictitious “recovery department” letterhead, the FDCPA treats you as a debt collector.
• Collecting for affiliates. A billing entity that collects for separately incorporated physician groups, labs, or sister hospitals may be collecting debts “owed to another.”
• Acquired accounts. A practice that buys or takes over another provider’s receivables after they are already in default can collect those accounts as a debt collector.

Even when the FDCPA does not reach you directly, it reaches the vendors you hire. Collection agencies, early-out vendors that operate after default, debt buyers, and collection law firms are all covered. Courts and regulators also expect creditors to supervise those vendors, and many state laws apply directly to first-party creditors. In practice, FDCPA medical debt standards have become the baseline for patient collections, regardless of who makes the call.

Regulation F Medical Debt Rules: What Changed

Regulation F took effect on November 30, 2021, and it turned many vague FDCPA standards into specific, testable requirements. Regulation F has no separate chapter on medical debt, but several provisions hit healthcare accounts especially hard because patient balances are often small, disputed, and tied to insurance.

The common thread is accuracy. Regulation F medical debt compliance depends on whether the amount, the creditor, and the account history in your placement file are correct before the first letter goes out.

Medical Debt and Credit Reporting in 2026

Credit reporting is where FDCPA medical debt rules meet the Fair Credit Reporting Act (FCRA), and the landscape has shifted several times since 2022. Here is where things stand as of October 2026.

Credit bureau policies still apply. In 2022 and 2023, Equifax, Experian, and TransUnion voluntarily stopped reporting medical collections under $500, removed paid medical collections, and extended the waiting period before unpaid medical debt appears from six months to one year.

The federal ban was vacated. The CFPB finalized a January 2025 rule that would have removed nearly all medical debt from credit reports. In July 2025, a federal judge in the Eastern District of Texas vacated it, finding it exceeded the Bureau’s authority under the FCRA.

State bans face a preemption challenge. Sixteen states have passed laws restricting medical debt reporting, and Rhode Island added its own ban in 2026. In October 2025, the CFPB issued an interpretive rule asserting that the FCRA broadly preempts these state laws. The rule is non-binding, and courts have not settled the question.

For providers, the practical takeaway is caution. Until courts resolve preemption, many organizations and their agencies continue to follow state reporting restrictions rather than test them. Any account that is reported must also satisfy Regulation F’s rule against reporting before first contact.

Other Medical Debt Collection Laws Providers Must Track

The FDCPA is only one layer. Several other medical debt collection laws shape what providers can bill, when, and how.

The No Surprises Act. Since 2022, this law has limited what providers can bill patients for many out-of-network emergency and facility-based services. Collecting more than the patient’s protected cost-sharing can falsely represent the amount owed under the FDCPA. The CFPB withdrew its 2022 compliance bulletin on this topic in May 2025, but the underlying statutory prohibitions did not change. Congress introduced resolutions to restore the bulletin in 2026.

HIPAA. Sharing protected health information with a collection agency is permitted for payment purposes, but only the minimum necessary. Agencies should sign business associate agreements, and letters and voicemails should never reveal diagnoses or sensitive service types.

IRS Section 501(r). Nonprofit hospitals must maintain a financial assistance policy and may not take “extraordinary collection actions,” such as credit reporting, lawsuits, or selling debt, until they make reasonable efforts to determine eligibility. That generally means waiting at least 120 days from the first post-discharge statement.

State laws. States increasingly regulate medical debt directly. Common rules include interest caps, bans on wage garnishment or home liens, mandatory financial-assistance screening, longer notice periods before collection, and licensing for agencies. Many states also have their own debt collection acts that, unlike the FDCPA, apply to original creditors.

Common FDCPA Medical Debt Violations

Most FDCPA medical debt lawsuits trace back to a handful of recurring mistakes, and nearly all of them start with bad data or unclear communication.

• Collecting the wrong amount. Balances that ignore pending insurance claims, contractual adjustments, or charity care eligibility can be treated as misrepresentations of the debt.
• Inflated or unauthorized fees. Adding interest, collection fees, or convenience fees not allowed by the patient agreement or state law violates the FDCPA’s ban on collecting unauthorized amounts.
• Misleading letters. Notices that obscure who the creditor is, misstate the validation period, or imply unintended legal action invite claims.
• Third-party disclosures. Leaving detailed voicemails, contacting employers, or emailing a shared family address can expose both the debt and health information.
• Ignoring disputes. Continuing to call or report an account after a timely written dispute, before verification is sent, is a frequent and easily proven violation.
• Inaccurate credit reporting. Reporting a balance that is under insurance review, already paid, or below bureau thresholds creates combined FDCPA and FCRA exposure.

The FDCPA allows actual damages, statutory damages of up to $1,000 per individual action, attorney’s fees, and class recoveries of up to $500,000 or 1% of the collector’s net worth. Because fees shift to the patient’s attorney, even small balances can produce large defense costs.

A Healthcare Collection Compliance Checklist

Strong healthcare collection compliance starts upstream in the revenue cycle, long before an account reaches an agency. Use this checklist to review your program.

• Resolve every insurance claim, appeal, and adjustment before placing an account with a collector.
• Screen patients for financial assistance and document the result, especially if you are a nonprofit hospital subject to 501(r).
• Verify No Surprises Act protections before billing out-of-network balances.
• Use your real name on all first-party statements and avoid letterhead that suggests a third party.
• Send placement files that include an itemization date and an accurate breakdown of charges, payments, and adjustments.
• Map state-specific rules for interest, fees, notice periods, credit reporting, and legal action for every state where your patients live.
• Require business associate agreements and only the minimum necessary data sharing with every vendor.
• Establish a written process to route patient disputes and complaints back to your billing team quickly.
• Audit agency letters, call logs, and recordings at least quarterly.

How to Vet a Collection Partner

Because most FDCPA medical debt liability sits with the agency, choosing the right partner is one of your biggest compliance decisions. Ask how the agency handles Regulation F call caps across multiple dates of service, how it tracks state law changes, and how it protects patient health information. Request sample validation notices, complaint data, and recent audit results.

Look for a partner whose approach reflects your patient relationships, not just recovery rates. Agencies like Kollecta, which specialize in patient-friendly, compliance-first healthcare collections, can help providers recover revenue while keeping communications respectful and compliant. Whoever you choose, put compliance obligations, audit rights, and indemnification in the contract.

The Bottom Line

The FDCPA may not name healthcare providers directly, but FDCPA medical debt rules shape nearly every step of patient collections. Regulation F sets precise standards for notices, calls, and credit reporting, while federal and state medical debt collection laws keep changing around it. Providers that clean up billing data, vet their partners, and audit regularly protect both their revenue and their patients’ trust.