HIPAA, while generally preventing the disclosure of your medical information to others, provides an exception in that it explicitly permits disclosure to debt collectors for the purpose of their collection on a medical debt. However, the exception limits the disclosure only to the extent necessary to collection on the debt, which still excludes the disclosure by a medical providor of details of the specifics of their medical services. In general, they are permitted to disclose the asserted amount and dates of a debt, but not the type of medical services and procedures rendered.
While details of the so-called "HIPAA process" are not discussed on this forum, the process in general asserts that once a medical debt is paid, the permissible disclosure under HIPAA to the extent necessary for "collection on a debt" is gone, and thus any and all records of medical debt provided to others must be expunged/deleted.
That interpretation of HIPAA has not been affirmed by appellate case law, and remains an interpretation, not law.
Regardless, if you have any disclosure of medical information that you consider to be a violation of HIPAA, such as a response to a DV that clearly provides details of medical procedures rendered, the recourse is to follow the HIPAA violation procedures by filing a complaint under the process set forth in the HIPAA statute..
There is no requirement that a HIPAA violation per se automatically requires total deletion of a reported collection from the consumer's credit report. Possible remedy might be to remove any details, such as the name of a medical provider that inherently discloses type of medical service (e.g., "American Oncology Services").
Response to a DV that asserts violation of HIPAA disclosure restrictions is a debt collectin practices matter between the consumer and the debt collector, and does not involve the CRA or provision of the info to your credit file. It is thus not per se a subject for a dispute under the FCRA or basis for requring deletion of unverifiable information reported to a CRA. You can contact an attorney and pursue an asserted violation of HIPAA, but if the purpose is to mandate deletion of their reported collection, that would not be a requirment under the FCRA or any relevant case law.
