Debt collectors have significant legal limits on how they can pursue medical bills. Under the Fair Debt Collection Practices Act (FDCPA) and recent Consumer Financial Protection Bureau guidance, they cannot collect amounts you've already paid, cannot contact you beyond certain hours or frequencies, cannot misrepresent what you owe, and must stop collection efforts if you dispute the debt in writing. Medical debt is vulnerable to collector abuse because a single hospital stay generates multiple bills, procedures may be covered by insurance unknowingly, and patients often don't know what they actually owe. Understanding what collectors legally cannot do gives you concrete tools to protect yourself.
Table of Contents
- What Collectors Cannot Charge You
- Contact Limits: Frequency and Hours
- Your Right to Demand Proof
- The Statute of Limitations Bars Their Lawsuit
- Medical Privacy: What They Cannot Disclose
- Credit Reporting: The $500 Threshold
What Collectors Cannot Charge You
Debt collectors cannot collect amounts you've already paid by insurance or government programs. The Consumer Financial Protection Bureau issued an advisory opinion in October 2024 stating that collectors are strictly liable for attempting to collect amounts already paid and must not misrepresent what you actually owe. If your insurance already paid the hospital, and a debt collector demands payment, that's illegal.
The CFPB also clarified that collectors cannot add fees, penalties, or interest that weren't in the original provider's contract or permitted by state law. If the hospital bill was $500 and the collector tries to collect $650, the extra $150 is illegal. Violating these rules gives you grounds to sue the collector for damages.
Contact Limits: Frequency and Hours
Debt collectors cannot call you more than seven times in any seven consecutive days about the same debt. The Fair Debt Collection Practices Act specifies that collectors also cannot call again within seven days after a phone conversation about that debt. More than seven calls within seven days creates a presumption of harassment.
Debt collectors may not contact you before 8 a.m. or after 9 p.m. in your local time zone without written consent. They cannot threaten you, lie about the amount owed, or claim legal authority to sue if the statute of limitations has passed in your state. If they break these contact rules, report them to the Consumer Financial Protection Bureau or your state's attorney general.
Your Right to Demand Proof
If you receive a collection notice and dispute the debt in writing within 30 days, the collector must immediately stop all collection efforts until they provide written proof the debt is valid. When you dispute the debt in writing, the Fair Debt Collection Practices Act requires the collector to cease collection and provide written proof of the debt, and violations allow you to sue for damages. Send your dispute by certified mail with a return receipt so you have proof of the request.
Ask the collector to verify the original contract, proof the hospital transferred the debt to them, evidence your insurance didn't pay it, and the exact amount owed. Many collectors cannot produce this documentation, especially for old or bundled debts. If they fail to respond within 30 days, that's another violation you can report.
The Statute of Limitations Bars Their Lawsuit
Debt collectors can only sue you for medical debt within your state's legal deadline. Different states set different limits: Arkansas allows only two years, while most states range from three to ten years. Once the statute of limitations expires in your state, collectors cannot legally sue you for that debt regardless of how old it is.
If a collector threatens to sue you about a debt beyond your state's deadline, they're violating the law. They can still call or send letters, but they cannot take you to court. If they continue claiming they'll sue after the statute has expired, you have grounds to sue them for violating the Fair Debt Collection Practices Act.
Medical Privacy: What They Cannot Disclose
Debt collectors are bound by HIPAA, the federal health privacy law. They can disclose your name, the amount owed, and billing dates, but cannot disclose your diagnosis, medical procedures, test results, or clinical notes. They also cannot publicly disclose your debt in ways designed to damage your reputation. If a collector reveals your medical condition, treatment, or procedure to others, that violates HIPAA.
You can file a complaint with the U.S. Department of Health and Human Services, which can levy significant fines. This protection is separate from and in addition to your rights under the Fair Debt Collection Practices Act.
Credit Reporting: The $500 Threshold
Medical debt under $500 no longer appears on your credit report. All three major credit reporting agencies—Equifax, Experian, and TransUnion—removed unpaid medical collections under $500 from credit reports in April 2023, and this removal remains in effect. Medical debt above $500 may still be reported and harm your credit score. If you pay off a medical debt that was already reported to the credit bureaus, ask the provider or collector to request its removal from your credit file.
A paid debt reported as unpaid continues to lower your score. Because of the $500 threshold, smaller medical debts are no longer worth aggressive collection efforts.