Compliance Checks That Come First

The Business Associate Agreement

A collection agency working provider accounts is a business associate under HIPAA, and a written business associate agreement must be executed before any protected health information transfers. Not promised, not in progress, executed.

HHS is explicit that the Privacy Rule does not prevent providers from using collection agencies and that billing, claims management, and collection activities fall within the definition of payment, provided the arrangement is documented. An agency that treats the BAA as a formality to be handled later is the wrong agency.

Ask what the agency does with your data at the end of the relationship, and get return or certified destruction into the agreement.

Minimum Necessary Discipline

Ask what data fields the agency requires at placement, and be suspicious if the answer includes clinical detail. An agency collecting a balance needs the patient's identity and contact information, the amount owed, dates of service, and the account history. It does not need diagnoses, clinical notes, or imaging.

An agency that asks for more than it needs is either careless about the minimum necessary standard or has not thought about it, and either answer predicts how it will handle the rest.

Security Posture

Confirm SOC 2 reporting, PCI compliance for payment handling, encryption in transit and at rest, and a breach notification obligation with a defined timeframe in the contract. A breach at the agency becomes the provider's problem too, since it involves the provider's patients.

Healthcare Specific Practice Checks

501(r) Awareness for Nonprofit Hospitals

If you are a nonprofit hospital organization, the agency's conduct is your compliance problem.

Under IRS section 501(r)(6), a hospital organization must make reasonable efforts to determine financial assistance eligibility before engaging in extraordinary collection actions, with a 120 day notification period and a 240 day application period running from the first post discharge billing statement. Extraordinary collection actions include reporting to credit bureaus, selling the debt, and legal action.

Critically, the hospital remains accountable for the extraordinary collection actions of third parties collecting on its behalf or buying its debt. Ask the agency directly how it tracks the 120 day threshold, how it handles an account where a patient applies for financial assistance mid collection, and whether it can suspend collection activity on request. An agency that has not heard of 501(r) should not have your accounts.

Current Credit Reporting Practice

This area changed twice recently and stale practice creates real risk.

The CFPB finalized a rule in January 2025 barring medical debt from consumer reports, and a federal court vacated it on July 11, 2025. It is no longer in effect. What remains in force are the credit bureaus' voluntary policies: paid medical collections are not reported, unpaid medical collections under $500 are not reported, and larger unpaid balances are not reported until a waiting period passes.

Ask the agency to state its current reporting practice, thresholds, and how quickly a paid account is updated. An agency describing the vacated rule as current law, or reporting balances below the threshold, is not tracking its own obligations.

Financial Assistance and Insurance Rework

Ask what the agency does when a patient says insurance should have paid, or that they qualify for financial assistance.

The right answer involves routing the account back rather than continuing to collect. A meaningful share of balances reaching agencies should have been resolved as billing corrections, secondary claims, or charity care determinations. An agency that treats every dispute as an obstacle rather than a possible error will generate complaints and collect balances that were never owed.

Operational and Financial Checks

Licensing in Every Relevant State

Collection agency licensing is state by state, and patients move. Verify licenses where your patients actually live, not just where your facility sits. Many state licenses are searchable through NMLS Consumer Access and individual state regulator databases.

Placing accounts with an agency unlicensed in the debtor's state creates exposure that flows back to the provider and can make the underlying balance unenforceable.

The Complaint Record

Search the agency in the CFPB's public consumer complaint database by company and product, and read the debt collection entries rather than counting them. Volume scales with placement volume; theme is the signal.

For healthcare agencies specifically, watch for patterns around attempts to collect debts consumers say they do not owe, and around failure to investigate disputes. Both point at process rather than tone.

Also ask whether the agency has been the subject of enforcement action by the CFPB, the FTC, or a state attorney general, and read the outcome.

Fee Structure and What It Costs on Small Balances

Medical portfolios skew toward small balances, which makes minimum fees per account the single most important economic term and the one least often volunteered.

An agency charging 35 percent with a $50 minimum is charging an effective 50 percent on a $100 recovery. On a book of $200 patient balances, that provision dominates the arithmetic. Get the rate by aging band, the minimum fee, whether the fee is gross or net of costs, the remittance schedule, and what happens when a patient pays the practice directly after placement.

Litigation Policy

Ask what percentage of accounts go to litigation, who authorizes each suit, and who bears court costs.

For healthcare providers this is a reputational question as much as a financial one. Hospital and practice lawsuits over patient balances draw local press coverage in a way rental collection suits do not. An agency that can file in your name without your approval is making that decision for you. Require written provider approval per filing.

Patient Experience and Escalation

The last check is the one that determines whether you keep the patient.

Ask how the agency handles a patient who calls upset, how quickly the practice is notified of a complaint, whether there is a compliance escalation path with a named contact, and what languages the agency supports. Ask for the actual first letter and listen to a call recording if the agency will provide one.

Then decide your own policy on whether patients who go to collections remain patients, write it down, and apply it consistently rather than case by case at the front desk. The same tension appears at every scale, and we covered it in dental collection agencies and in our walkthrough of the patient collections process.

Before You Sign

Run a small test placement rather than committing volume, and compare net dollars returned rather than quoted rates. An agency quoting 40 percent that recovers 30 percent nets you more than one quoting 28 percent that recovers 22.

Ask for two references in healthcare with similar balance profiles and call them, asking specifically what happened the last time a patient disputed an account and how fast the agency responded.

And read the termination clause, since a provider who wants to withdraw unworked accounts discovers the terms only when trying. The broader contract review checklist applies here too, alongside our general guides to choosing a collection agency and finding the right medical collection partner.

Advanced Collection Bureau works medical and dental patient balances on contingency alongside residential placements, executes business associate agreements before placement, and will walk through fee structure, reporting practice, and escalation before anything moves. The team can be reached at 321-633-4999 or through the get started page.