What Debt Collectors Can and Cannot Do With Your Medical Bills

A debt collector is calling about a medical bill. Maybe it's a bill you thought insurance covered. Maybe you never even received the original statement. Maybe you're being hounded over a balance you already disputed with the hospital.

Whatever brought you here: you have rights. Federal law strictly regulates what debt collectors can say, when they can call, and what they can threaten. Most of those protections are in a single statute -- the Fair Debt Collection Practices Act (FDCPA) -- and most patients have never heard of it. (Source: 15 USC 1692 et seq., Cornell Law Institute)

Here is what they can do, what they cannot do, and what you can do in response.

Who the FDCPA Actually Covers

The first thing to understand: the FDCPA only applies to third-party debt collectors and debt buyers. It does not apply to a hospital or doctor's office collecting its own bills. (Source: 15 USC 1692a(6))

This distinction matters. If your hospital's billing department calls you directly, the FDCPA's specific protections don't kick in. But the moment your account gets handed to an outside collection agency -- or sold to a company that buys defaulted debts -- you're covered.

The false-name exception: Some hospitals try to blur this line by operating collection departments under names that sound like independent agencies. If the entity contacting you has a different name than your healthcare provider, the FDCPA likely applies regardless of the underlying corporate relationship. This is codified directly in the statute: any creditor who "uses any name other than his own which would indicate that a third person is collecting" is treated as a debt collector. (Source: 15 USC 1692a(6))

Practical test: If you're not sure, ask. "Are you a representative of [hospital name], or are you a separate collection company?" The answer determines your rights.

Your Right to Demand Proof

When a debt collector first contacts you about a medical bill, they must send you a written validation notice within five days. That notice must include the amount of the debt, the name of the original creditor, and a statement that you have 30 days to dispute. (Source: 15 USC 1692g)

This is your most powerful tool. Here's how to use it:

1. Send your dispute in writing within 30 days of receiving the validation notice. A phone call is not enough. The statute requires written notice to trigger the collector's obligation to stop and verify. Send it certified mail with return receipt so you have proof.

2. Once you send a written dispute, the collector must stop all collection activity until they provide you with written verification of the debt. Not a phone call. Not a vague letter. Verification. (Source: 15 USC 1692g(b))

3. You don't need a reason. You are not required to explain why you're disputing. "I am requesting written verification of this debt" is a complete sentence and a legally sufficient dispute.

Under Regulation F -- the CFPB's 2021 implementing rule -- the validation notice must also include an itemization of the debt showing how the balance was calculated, including interest, fees, payments, and credits. (Source: 12 CFR 1006.34)

If a collector contacts you and never sends a validation notice, that's already a violation.

What Collectors Cannot Do

The FDCPA prohibits a long list of specific practices. These are not guidelines or suggestions -- they are federal law, and violations carry penalties.

They cannot threaten you with arrest or jail. Medical debt is a civil matter. Threatening imprisonment for not paying a medical bill violates the FDCPA's prohibition on representing "that nonpayment of any debt will result in the arrest or imprisonment of any person." (Source: 15 USC 1692e(4))

They cannot threaten to garnish your wages without a court judgment. Wage garnishment requires a lawsuit, a court hearing, and a judgment in the collector's favor. Threatening garnishment before any of that has happened is threatening an action that "cannot legally be taken." And in four states -- Texas, Pennsylvania, North Carolina, and South Carolina -- wage garnishment for medical debt is prohibited even with a judgment. (Source: 15 USC 1692e(5))

They cannot add unauthorized fees or interest. A collector can only collect the amount authorized by the original agreement or permitted by law. If your bill was $3,200 at the hospital and the collector is demanding $4,100, ask what accounts for the difference -- and demand documentation. (Source: 15 USC 1692f(1))

They cannot discuss your debt with your family, friends, or coworkers. The FDCPA limits who a collector can talk to about your debt: you, your attorney, a consumer reporting agency, or the original creditor. That's it. No calling your parents. No telling your neighbor. No leaving messages with your spouse unless they are a co-debtor or your authorized representative -- the FDCPA has no blanket spouse exception. (Source: 15 USC 1692c(b))

They cannot call at unreasonable hours. Calls before 8 a.m. or after 9 p.m. in your local time zone are presumed violations. (Source: 15 USC 1692c(a)(1))

They cannot blow up your phone. Under Regulation F, more than seven calls within seven consecutive days about the same debt creates a presumption of harassment. And that limit is per debt -- a collector with three of your accounts could theoretically call 21 times per week, though the general harassment standard still applies. (Source: 12 CFR 1006.14(b)(2)(i))

They cannot post about your debt on social media. Regulation F explicitly prohibits debt collection communications "viewable by the general public or the person's social media contacts." Private direct messages are permitted -- but must include opt-out instructions. (Source: 12 CFR 1006.22(f)(4))

They cannot use abusive or profane language. This seems obvious, but it still happens. (Source: 15 USC 1692d)

They cannot ignore your cease-and-desist letter. If you send a written request to stop contacting you, the collector must comply -- with three narrow exceptions: they can send a final notice that they're ending collection efforts, a notice that they may pursue a specific legal remedy, or a notice that they are pursuing one (like filing a lawsuit). (Source: 15 USC 1692c(c))

A critical caveat: a cease-and-desist stops the calls. It does not erase the debt. The collector can still sue you. If you're dealing with a large balance, consider speaking with a consumer law attorney before sending a cease-and-desist letter.

The Statute of Limitations on Medical Debt

Every debt has a legal expiration date for lawsuits. After the statute of limitations runs out, a collector can still ask you to pay -- but they cannot sue you or threaten to sue you. Regulation F explicitly prohibits filing or threatening litigation on time-barred debt. (Source: 12 CFR 1006.26(b))

The statute of limitations varies by state, typically ranging from 3 to 10 years for medical debt. The most dangerous trap: making even a small payment on old debt can restart the statute of limitations in many states. When a collector asks you to "just pay $50 to show good faith" on an old bill, they may be trying to reset the clock so they can sue you for the full balance. Never make a payment on old debt without understanding your state's revival laws. (Source: NCLC, Limits on Collection of Time-Barred Debt)

For the complete state-by-state breakdown (all 50 states plus DC), anti-revival protections, and what to do if you are sued on time-barred debt, see our full guide to the medical debt statute of limitations by state.

The Nonprofit Hospital Shield: 501(r)

If your medical debt came from a nonprofit hospital -- and roughly 57% of U.S. community hospitals are nonprofit -- you have an additional layer of protection that most patients never learn about.

Under Section 501(r) of the Internal Revenue Code, tax-exempt hospitals must:

1. Maintain a written Financial Assistance Policy (FAP) covering all emergency and medically necessary care
2. Wait at least 120 days from the first billing statement before sending you to collections
3. Give you 30 days' written notice before taking any "extraordinary collection action" -- which includes selling your debt, reporting it to credit agencies, or filing a lawsuit
4. Allow a 240-day application period for financial assistance

(Source: IRS, Section 501(r)(6) Billing and Collections)

If a nonprofit hospital skipped these steps before sending your bill to collections, the collection itself may be invalid. You can report potential 501(r) violations to the IRS using Form 13909. And you should ask the hospital directly: "Did you offer me financial assistance before sending this to collections?" If they didn't, they have a problem.

For more on financial assistance programs, see what to do when you can't afford your medical bill.

What You Can Do

You are not limited to enduring collection calls. Here are your options, ranked by effectiveness.

1. Send a Debt Validation Letter

Within 30 days of receiving the collector's validation notice, send a written dispute via certified mail. Demand they verify the debt, including the name of the original creditor and an itemized breakdown of the balance. Many collection accounts involve debts that have been sold multiple times -- the current collector may not have proper documentation.

2. File a State Attorney General Complaint

This is now your most reliable enforcement channel. State AGs have independent authority to enforce the FDCPA within their jurisdictions, and most have active consumer protection divisions that handle debt collection complaints. (Source: 15 USC 1692l(c))

Why state AGs over the CFPB? Because the CFPB has been gutted. Staffing has been cut from roughly 1,700 to 550 employees, with enforcement staff reduced by approximately 80% and supervision staff by 83%. The agency's medical debt advisory opinion was withdrawn in July 2025. Federal enforcement, for the moment, is largely theoretical. (Source: ABC News/AP, April 2026)

You can still file a CFPB complaint at consumerfinance.gov/complaint -- it creates a record, and collectors are required to respond. But don't rely on the CFPB to take action on your behalf. Direct your energy toward your state AG and, if warranted, a private attorney.

3. Sue Under the FDCPA

The FDCPA includes a private right of action. If a collector violates the law, you can sue for:

• Actual damages (whatever the violation cost you)
• Statutory damages up to $1,000 per lawsuit
• Attorney's fees and court costs -- this is what makes FDCPA cases viable. Consumer attorneys often take these cases on contingency because the statute guarantees fee recovery for the prevailing plaintiff.

(Source: 15 USC 1692k)

Important: You must file within one year of the violation. That clock starts when the violation occurs, not when you discover it. If a collector is breaking the law, act fast. Find a consumer attorney through the National Association of Consumer Advocates or see our guide to finding legal help for medical debt.

4. Check for No Surprises Act Violations

If the underlying bill involves surprise out-of-network charges from an emergency visit or at an in-network facility, you may have protections under the No Surprises Act -- and those extend to the collection phase. A collector cannot legally collect on a balance-billing amount that was prohibited by federal law. The CFPB confirmed this in Bulletin 2022-01: misrepresenting that a consumer must pay an amount prohibited by the No Surprises Act violates the FDCPA. (Source: CFPB Bulletin 2022-01)

If a medical debt collector is violating your rights, document everything -- dates, times, what was said, who called. That documentation becomes evidence if you file a complaint or lawsuit. For a broader overview of your rights as a patient, see our complete patient rights guide. For help understanding how medical debt works from start to finish, see our guide to understanding medical debt.

This article is for educational purposes only and does not constitute legal advice. Laws vary by state and individual circumstances differ. If you are facing legal action from a debt collector, consult a qualified attorney in your state.