Can Debt Collectors Share Medical Information in Texas?

A debt collector can tell you that you owe money for a medical bill. It generally cannot broadcast your diagnosis, treatment, or the reason you saw a doctor to people who have nothing to do with paying that bill.

The legality of any specific disclosure depends on what was shared, who received it, how it was communicated, and which law applies. HIPAA, the federal Fair Debt Collection Practices Act (FDCPA), Regulation F, and Texas statutes each play a different role.

This article explains those roles in plain terms. It's general information for Texas consumers, not a determination that any particular disclosure was lawful or unlawful.

Key Takeaways

• Stating that a medical debt exists differs sharply from revealing your diagnosis or treatment details.
• HIPAA mainly binds providers and their business associates; collectors fall under the FDCPA, Regulation F, and Texas law.
• Save every letter, voicemail, and message before disputing a debt or filing a complaint.
• A valid debt doesn't excuse harassment, public shaming, or needless exposure of health information.

Can Debt Collectors Share Medical Information in Texas?

Here's the short version for Texas consumers: a private, limited communication about an unpaid account is different from disclosing the medical details behind it.

What's typically considered "necessary" to collect a debt includes:

• Your name and contact information
• The original creditor or provider's identity
• The account balance
• Payment instructions or options

That's the basic skeleton of a debt. It doesn't require mentioning why you needed care in the first place.

Why Medical Details Carry More Risk

A diagnosis, procedure, medication, or condition is more sensitive than a dollar amount. Telling someone "you owe $1,200" reveals a financial fact. Telling someone "you owe $1,200 for cancer treatment" reveals a health fact you never agreed to share with that person.

This distinction matters most when you look at who received the information:

• A private notice mailed or emailed directly to you is standard collection practice.
• Disclosing the same debt (and the underlying condition) to your employer, a relative, a neighbor, or a social media audience is a different situation entirely.

Example comparison:

Forest Hill Management, like other account servicers, typically identifies the original creditor associated with a transferred account in written correspondence. That's the kind of account-identifying detail that helps you confirm what you owe. It isn't the same as disclosing clinical information to outside parties.

Which Laws Control Medical-Debt Disclosures?

Three separate legal frameworks intersect here, and they don't always cover the same actors.

HIPAA's Narrow but Real Role

HIPAA governs covered health plans, clearinghouses, and providers, plus their business associates. When a provider hires a collection agency, that agency may become a business associate and can receive protected health information for payment purposes under HIPAA's payment provisions.

Even then, the "minimum necessary" standard applies. Providers are expected to share only what a collector needs to do its job, not a full medical chart.

Important nuance: an independent collector isn't automatically bound by HIPAA just because the bill happens to be medical. Whether HIPAA applies depends on its actual role and relationship to the provider, not the type of debt it's collecting.

FDCPA and Regulation F: Communication Limits

Once a collector is covered by the FDCPA, Regulation F's third-party communication rule restricts who it can talk to about your debt. Ordinarily, that's limited to you, your attorney, the creditor, or a consumer reporting agency. Friends, employers, and family are off-limits, aside from a narrow exception for locating you.

Other Regulation F limits also apply:

• Voicemails must generally stick to a defined "limited-content message" (a callback request) rather than debt or medical details.
• Envelopes can't reveal that the letter concerns a debt.
• Electronic messages need a clear opt-out method.

Texas Adds Its Own Layer

Texas Finance Code Chapter 392 defines "debt collector" broadly and bans specific misconduct. That includes telling a third party that you're "willfully refusing" to pay a debt you've disputed in writing, as well as abusive language and deceptive representations.

Texas Health and Safety Code Chapter 181 separately defines "covered entity" more broadly than HIPAA does, meaning some entities outside HIPAA's reach may still owe medical-privacy duties under Texas law.

A privacy claim and a collection-practices claim can involve different defendants, different agencies, and different deadlines. Don't assume one law covers everything.

Warning Signs That a Medical-Information Disclosure May Be Improper

Watch for these red flags:

• A collector discloses your debt to a third party who has no role in payment or collection
• Details about your diagnosis appear in a voicemail, text, or letter to someone other than you
• Your employer receives unnecessary health information alongside a payment demand
• The collector posts or threatens to post your debt or health details publicly
• The disclosure comes with repeated calls, profanity, false legal threats, or misleading statements

Context matters. An accidental misdial that reveals nothing sensitive isn't the same as a deliberate, detailed disclosure to your workplace. Before assuming a violation occurred, ask:

1. What exactly was disclosed?
2. Who received it?
3. Did you give consent?
4. Was the recipient actually involved in payment or collection?
5. Was the information accurate and genuinely necessary?

Your answers help you, a regulator, or an attorney decide whether a violation occurred.

What to Do If a Debt Collector Shared Your Medical Information

Take these steps in order and keep written records of everything you send or receive.

1. Preserve everything. Save the original collection letter, billing statements, emails, texts, voicemails, screenshots, call logs, and credit-report entries. Don't alter or delete originals, even if you make working copies.
2. Request debt validation in writing. Ask for the creditor's identity, account details, the amount claimed, and the collector's mailing address. You do not need to share extra medical information to get validation.
3. Dispute inaccuracies in writing. Use certified mail or another method that gives proof of delivery. Disputing a debt is not the same as admitting you owe it.
4. Report the conduct through the right channel:
   • CFPB (consumerfinance.gov/complaint) for collection-practice issues
   • FTC (reportfraud.ftc.gov) for scams or fraud
   • Texas Attorney General's Consumer Protection Division for state-law violations
   • HHS Office for Civil Rights if a covered health provider or business associate disclosed information improperly
5. Talk to a consumer-protection or privacy attorney if the disclosure was public, reached an employer or family member, caused real harm, or continued after written notice.

If a notice names Forest Hill Management or any other collector, confirm the contact details on the notice or the company's official website before you reply. Use secure channels only, and do not send medical records unless they are truly necessary and requested through a verified process.

Frequently Asked Questions

What should I do if I receive a debt collection letter?

Verify the debt, preserve the letter, and request validation in writing before paying anything. Check for inaccuracies, and never ignore a lawsuit or response deadline, even if you plan to dispute the debt.

How quickly do medical bills get sent to collections?

Timing varies widely by provider, insurance processing, and internal billing-dispute policies. There's no fixed nationwide timeline, so review the account details before assuming the debt is accurate or overdue.

What can a debt collector legally do in Texas?

Collectors can pursue payment through calls, letters, and validation notices. Texas and federal law still restrict harassment, deception, threats, and unnecessary third-party disclosures of your medical information.

Do I have to pay medical bills that have been sent to collections?

Being sent to collections doesn't automatically prove the amount is accurate. You still have dispute rights, but don't ignore validation notices, settlement offers, or court papers if a lawsuit is filed.

How do I deal with debt collectors for medical bills?

Communicate in writing, document everything, and request debt validation. Check for insurance or billing errors, protect sensitive health details, and seek legal or regulatory help if a collector's conduct seems improper.

Is medical debt still being removed from credit reports?

The major credit bureaus still remove paid medical collections and smaller unpaid balances under their own policies. A separate federal rule aimed at broader removal was struck down in court in 2025. Check your credit report directly and dispute any inaccurate medical-debt entries.