Please read up on the HIPAA laws, specifically the laws that pertain to the OC's business associates, the minimum necassary, protected healthcare information and business purposes (or PP to have PHI). Also, look into the FCRA's laws on how med collections are to be reported. Let's not confuse med collections with other collections!
Usually, an OC will not discuss the debt once they have placed it into collection. They hired the CA because they did not want to be troubled with it, and that is what they are paying the CA to do. You can try contacting the OC, but I would not expect any results.