Write a letter with something like this.
I believe you are in violation of HIPAA laws that protect my medical privacy. In attempting to validate a debt that you allege I owe a medical provider, you mailed me two detailed medical bills. While one of the medical bills was in my name, the other medical bill is for a person who I do not know and who is not related to me. I am clearly not responsible for the second bill that you mailed to me.
Please respond to me in writing as soon as possible with an explanation as to how this could have occurred. Do you, in fact, have a second bill in my name that you believe I owe a medical provider? Is my receipt of someone else's confidential medical information an administrative error? Have you, at any time, shared my confidential medical information with any other individual for any other purpose? It is important that you provide me with a detailed explanation of your actions in this matter so that I can decide whether or not to pursue any of my legal remedies.
Further, since you have been unable to provide me with sufficient documentation of any debt that I owe with respect to this second bill (for a stranger), I expect that you will take immediate action to stop collection activities on this clearly erroneous debt, halt any current reporting to the credit reporting agencies with respect to this debt, and remove any entries that you may have made on my credit reports related to this debt.
You should understand that I fully intend to pursue this matter with all relevant authorities should you fail to respond to this letter within a timely manner, including (my state's) attorney general, (your state's) attorney general, as well as the original creditor who hired you to collect this medical debt, and possibly local courts with jurisdiction.
(I would also include an offer to pay on the correct debt with language about how HIPAA obligates them to immediately cease reporting collection accounts on paid medical debts--you might be able to short circuit the HIPAA process by basically making a PFD offer for your silence on raising hell on this flagrant HIPAA violation. If they don't go for it, then just keep doing the HIPAA process on that first debt.)
