What HIPAA actually allows on your credit report
HIPAA's rules define "payment" to include disclosure to consumer reporting agencies of six items: name and address, date of birth, Social Security number, payment history, account number, and the name and address of the provider or health plan. So a medical collection showing those facts isn't a HIPAA violation by itself, and a letter that only says "this violates HIPAA" gives the bureau nothing to fix.
- Myth: the bureau must delete any medical debt unless it has your signed HIPAA authorization. Reality: no authorization is needed for those six billing items, and credit bureaus aren't covered by HIPAA at all — the Fair Credit Reporting Act governs them.
- Where HIPAA matters: if a collector or provider sent clinical details — a diagnosis, procedure or treatment — that's more than the rule allows. Dispute the entry with the bureau and file a complaint with the HHS Office for Civil Rights.
Medical collections that really shouldn't be there
Under the three bureaus' own policies, these medical collections shouldn't appear: paid medical collections, medical collections with an original balance under $500, and unpaid medical collections less than a year old. (A broader CFPB rule to remove medical debt was vacated by a federal court in July 2025; some states go further.) If yours fits, the free letter below disputes it under FCRA section 611 — the bureau generally has 30 days to investigate and must fix or delete what's wrong. More detail on our medical bill dispute letter page.
Sample credit dispute letter
This is exactly what the builder produces for an example medical collection under $500. Use the tool above to make yours.
October 20, 2026
Jane Doe
123 Main St
Columbus, OH 43215
Date of birth: 01/31/1990
Social Security number: XXX-XX-1234
Experian
P.O. Box 4500
Allen, TX 75013
Re: Dispute of inaccurate information in my credit report
To whom it may concern:
I am writing to dispute the following information in my Experian credit file. The items I dispute are circled on the enclosed copy of my report.
1. Healthcare Recovery Services (medical), account ending in 5521: This medical collection should not appear on my credit report because the original balance was $380, under the $500 the credit bureaus no longer report. The nationwide credit reporting companies do not report paid medical collection debt, medical collections with an original balance under $500, or medical debt that is less than one year past due. I request that this item be deleted.
Under section 611 of the Fair Credit Reporting Act (15 U.S.C. § 1681i), please conduct a reasonable reinvestigation of these items, forward the information I have provided to the companies that reported them, and delete or correct any information that is inaccurate, incomplete or cannot be verified. Please send me the results of your reinvestigation in writing and, if my file changes, a free copy of my updated credit report.
Enclosed are:
- A copy of my credit report with the disputed items circled
- A copy of my driver's license or other government ID
- A copy of a utility bill or bank statement showing my current address
Sincerely,
Jane Doe
General information and sample letters, not legal advice. Numlight is not a law firm or a credit repair organization and doesn't send letters for you. Only dispute information you believe is inaccurate or incomplete. Sources: CFPB — disputing credit report errors; 15 U.S.C. § 1681i; 12 CFR § 1006.34.
