@RobertEG wrote:
The HIPAA statute does not require purging of medical information that was retained for purposes of collection on a debt.
The statute does not go into that detail, or even make such a purge requirment.
The "purge requirement" is only an interpretation of HIPAA that serves as the basis for the so-called HIPAA process.
Yes, a debt collector might choose to delete, notwitstainding their credit reporting agreement not to do so, but I would not assert that it is based on any HIPAA reqirement other than an interpretation that has not been affirmed in the case law.
Listen, I spoke with HHS, I wouldn't be sharing this information if it weren't true. There is no permissable purpose to allow third party "business associates" to retain and share medical information for the purpose of determining your credit worthiness.
The only permissable purpose covered under these circumstances, on having access to and sharing medical information regarding a patient is for the purpose of "collecting payment for a medical provider". Once that purpose is no longer applicable, they are no longer covered and are not legally allowed to have the information, unless the patient specifically allows them access in writing, via the original source of the medical data (hospital, doctor, etc).
