HIPPA has nothing to do with credit as you might know. It is patient record privacy. I am all too familiar with it because I have worked for 3 hospitals. What they can't do on a report is share your patient information, like saying it is a medical collection for a specific surgery or something indicating your condition or health. They can continue to say it was a medical record and the only thing that they are bound by in reporting it that way is found in the FCRA. If they are harassing you, then it is the FDCPA. Unfortunately, you will find no information in FCRA about this subject.