The Fair Debt Collection Practices Act has been federal law since 1977, but the CFPB still receives over 120,000 debt collection complaints per year — and medical debt is the single largest category. According to BillKarma's analysis of 4,200 collection notices uploaded by users, 23% showed signs of at least one FDCPA violation, from inflated balances to calls outside legal hours. Knowing your rights is not optional — it is your best defense against collectors who break the rules.
1. What is the FDCPA and who does it protect?
The Fair Debt Collection Practices Act (FDCPA) is a federal law (15 U.S.C. § 1692 et seq.) that prohibits abusive, deceptive, and unfair debt collection practices. It applies specifically to third-party debt collectors — companies that collect debts they did not originate. This includes collection agencies that buy medical debt from hospitals and agencies that collect on behalf of hospitals for a fee.
The FDCPA does not apply to the original hospital billing department. However, the moment a hospital sends your account to an outside collector or sells the debt, all FDCPA protections activate.
| Who contacts you | FDCPA applies? | Your protections |
|---|---|---|
| Hospital billing department | No | State consumer protection laws; you can still dispute and negotiate |
| Collection agency (collecting for hospital) | Yes | Full FDCPA protections — validation rights, contact limits, anti-harassment rules |
| Debt buyer (purchased your debt) | Yes | Full FDCPA protections plus they must prove they own the debt |
BillKarma data shows that the median time from a hospital sending a bill to it reaching a third-party collector is 127 days. If you are within that window, you still have time to dispute errors with the hospital directly before collections begins.
2. 8 things medical debt collectors cannot do
1. Call before 8 a.m. or after 9 p.m.
Collectors cannot call you before 8:00 a.m. or after 9:00 p.m. in your local time zone. This includes calls, voicemails, and text messages. If a collector based in New York calls you in California at 6:00 p.m. Eastern (3:00 p.m. Pacific), that is legal. But if they call at 9:30 p.m. your local time, that is a violation.
2. Harass you with repeated calls
The FDCPA prohibits calling repeatedly or continuously with the intent to annoy, abuse, or harass. While there is no specific limit on the number of calls per day in the original FDCPA, the CFPB's 2021 Regulation F limits collectors to 7 call attempts per debt in a 7-day period, and they cannot call within 7 days of having a phone conversation with you about the debt.
3. Threaten violence or use profane language
A collector cannot threaten you with physical harm, use obscene language, or make threats they cannot legally carry out. Statements like "we will have you arrested" or "we will garnish your wages tomorrow" (without a court judgment) are illegal threats.
4. Misrepresent the amount you owe
Collectors cannot inflate the balance by adding unauthorized fees, interest, or collection costs unless your original agreement or state law specifically allows it. BillKarma's review of collection notices found that 12% included amounts higher than the original hospital bill with no explanation for the difference.
5. Discuss your debt with others
A collector can contact a third party exactly one time, and only to locate you — not to discuss the debt. They cannot tell your family, employer, neighbors, or anyone else that you owe money. The exception is your spouse, your parents (if you are a minor), and your attorney.
6. Contact you at work after you say stop
If you tell a collector — verbally or in writing — that your employer does not allow personal calls, they must stop calling your workplace immediately.
7. Continue collecting after you request validation
If you send a written debt validation request within 30 days of the first contact, the collector must stop all collection activity until they provide written proof that the debt is valid and they have authority to collect it. Continuing to call, send letters, or report to credit bureaus during this period is a violation.
8. Threaten lawsuits they don't intend to file
A collector cannot threaten to sue you unless they actually intend to do so and the debt is within the statute of limitations. Threatening to sue on time-barred debt is an FDCPA violation that courts take seriously.
| Violation | FDCPA Section | What to document |
|---|---|---|
| Calls outside legal hours | § 1692c(a)(1) | Screenshot of call log with timestamps |
| Excessive calls | § 1692d(5) | Call log showing frequency and dates |
| Threats or profanity | § 1692d | Voicemail recordings, notes with date/time |
| Inflated balance | § 1692e(2)(A) | Compare collection notice to original bill |
| Disclosing to third parties | § 1692c(b) | Witness statements, written records |
| Contacting at work after objection | § 1692c(a)(3) | Written objection copy, continued call records |
| Collecting during validation period | § 1692g(b) | Certified mail receipt for validation letter, continued activity records |
| Threatening lawsuit on time-barred debt | § 1692e(5) | Collection letter or voicemail, SOL calculation for your state |
3. Annotated collection notice: spotting violations
Here is a typical medical debt collection notice with potential violations flagged:
Red flags in this notice:
- The collection amount is $443 more than the original bill — this may be an unauthorized fee (potential § 1692e violation)
- The threat of wage garnishment requires a court judgment first — if the collector has not filed suit, this is misleading
- The date of service is over 3 years ago — in many states, this debt is past the statute of limitations
4. How to respond when a collector breaks the rules
Step 1: Document everything
Start a file for this debt. Save every letter, screenshot every call log entry, record voicemails (check your state's recording laws — most allow one-party consent), and write down the date, time, and content of every phone call immediately after it happens.
Step 2: Send a debt validation letter within 30 days
Under FDCPA § 1692g, you have 30 days from the first contact to demand written validation. This forces the collector to prove the debt is yours, the amount is correct, and they have authority to collect. Use our debt validation letter generator to create and send a legally correct letter via certified mail.
Step 3: Send a cease-and-desist letter if calls are harassing
If the collector is calling excessively or at illegal hours, send a written cease-and-desist letter via certified mail. After receiving it, the collector can only contact you by mail, and only to confirm they are ceasing contact or to notify you of specific legal action.
Step 4: Check your original bill for errors
Many collection amounts are wrong because the underlying hospital bill contained errors. Upload your original bill to BillKarma to check for duplicate charges, unbundled codes, and services you never received. If the original bill is wrong, the collection amount is wrong too.
Step 5: File complaints
Report FDCPA violations to the CFPB, the FTC, and your state attorney general. Complaints create a paper trail that strengthens your position if you sue and helps regulators identify repeat offenders.
5. Filing complaints and lawsuits
Where to file complaints
| Agency | What they do | How to file |
|---|---|---|
| CFPB | Investigates and takes enforcement action against debt collectors | consumerfinance.gov/complaint |
| FTC | Tracks patterns of abuse, brings enforcement cases | reportfraud.ftc.gov |
| State Attorney General | Enforces state consumer protection laws (often stricter than federal) | Search "[your state] attorney general consumer complaint" |
Suing under the FDCPA
You can sue a debt collector for FDCPA violations in federal or state court within one year of the violation. Damages available:
- Statutory damages: Up to $1,000 per case (not per violation)
- Actual damages: Lost wages, emotional distress, medical costs caused by the harassment
- Attorney fees and court costs: The collector pays your legal bills if you win
Many consumer rights attorneys take FDCPA cases on contingency — you pay nothing upfront and the attorney collects fees from the collector if you win. The National Association of Consumer Advocates (NACA) has a directory of attorneys who specialize in debt collection cases.
6. How to protect yourself from the start
- Send a validation letter within 30 days of first contact. This is the single most important step. It pauses collection activity and forces the collector to prove their case. Use our letter generator to send one via certified mail.
- Never acknowledge the debt verbally. Don't say "I know I owe this" or "I can't pay right now." Acknowledgment can be used against you and may reset the statute of limitations in some states.
- Request all communication in writing. This creates a paper trail and reduces opportunities for verbal harassment or misrepresentation.
- Check the original bill for errors. BillKarma's analysis of bills that ended up in collections found that 38% contained billing errors — duplicate charges, unbundled codes, or insurance that was never filed. Errors in the original bill mean errors in the collection amount.
- Know your state's statute of limitations. If the debt is time-barred, the collector cannot sue you. Use our statute of limitations calculator to check.
- Never make a partial payment without a plan. In many states, a partial payment resets the statute of limitations clock, giving the collector a fresh window to sue you.
7. Real cases of FDCPA violations
Case 1: Inflated balance — $1,200 in unauthorized fees
A patient received a collection notice for $5,847 on an ER visit originally billed at $4,620. The collector had added $1,227 in "administrative fees" and "processing charges" not authorized by the original hospital agreement or state law. The patient sent a validation letter, compared the collection amount to the original bill, and filed a CFPB complaint.
The collector could not justify the added fees. The patient negotiated a settlement at 35% of the original bill amount ($1,617) and filed a state court claim for the FDCPA violation.
Total savings: $4,230 off the inflated balance. The collector also paid $1,000 in statutory damages.
Case 2: Calls at illegal hours — harassment documented
A collector called a patient 14 times in one week about a $2,300 medical bill, including three calls after 9 p.m. local time and two calls to the patient's workplace after being told to stop. The patient documented every call with screenshots and filed complaints with both the CFPB and state attorney general.
A consumer attorney took the case on contingency. The collector settled for $3,500 — $1,000 in statutory damages plus $2,500 in actual damages for documented emotional distress and lost work time.
The patient received $3,500 and the underlying $2,300 debt was included in the settlement agreement.
Case 3: Lawsuit threat on time-barred debt
A patient received a collection letter threatening a lawsuit for a $3,100 hospital bill from 2019. The patient checked the statute of limitations for their state (California — 4 years for written contracts) and confirmed the debt was time-barred. The collection letter threatening legal action on a time-barred debt was a clear FDCPA § 1692e(5) violation.
The patient's attorney sent a demand letter citing the violation. The collector withdrew the claim, ceased all contact, and paid $1,000 in statutory damages plus attorney fees.
Result: $3,100 debt dropped, $1,000 statutory damages received.
Frequently asked questions
Does the FDCPA apply to hospital billing departments?
No. The FDCPA only covers third-party debt collectors — companies that collect debts on behalf of another creditor or that purchased the debt. Hospital billing departments contacting you directly are not covered. However, many states have consumer protection laws that apply to original creditors as well. Once a hospital assigns or sells your debt to an outside agency, full FDCPA protections apply.
How do I file an FDCPA complaint against a medical debt collector?
File with the CFPB, the FTC at reportfraud.ftc.gov, and your state attorney general's consumer protection office. Document everything — save voicemails, screenshot call logs, and keep copies of all letters. You can also sue the collector in court within one year of the violation and recover up to $1,000 in statutory damages plus actual damages and attorney fees.
Can a medical debt collector call my family or employer?
A collector can contact a third party once, and only to find your location — never to discuss your debt. They cannot tell your family, friends, or employer that you owe money. If you tell them to stop calling your workplace, they must comply immediately. Violating this is an FDCPA offense you can report and sue over.
What happens if a debt collector violates the FDCPA?
You can sue in federal or state court within one year. You may recover up to $1,000 in statutory damages, plus actual damages for things like lost wages or emotional distress, plus your attorney fees. Many consumer rights attorneys handle FDCPA cases on contingency — no cost to you unless you win. Filing complaints with the CFPB and state AG also creates a record that can support enforcement actions.
Can a debt collector add interest or fees to my medical bill?
Only if your original agreement with the hospital or a specific state law authorizes it. Most medical debt agreements do not include interest clauses. If a collector inflates your balance with unexplained fees, compare the collection amount to your original bill and EOB. Any unauthorized additions are an FDCPA violation under § 1692e(2)(A) and § 1692f(1).
How do I stop a medical debt collector from calling me?
Send a written cease-and-desist letter via certified mail. Once received, the collector can only contact you by mail and only to confirm they are stopping contact or to notify you of specific legal action like filing a lawsuit. This does not eliminate the debt, but it stops the calls and gives you space to review your bill for errors and plan your next steps.
Sources
- FTC: Fair Debt Collection Practices Act — Full Text (15 U.S.C. § 1692)
- CFPB: Regulation F — Debt Collection Practices Final Rule (2021)
- CFPB: Consumer Response Annual Report — Debt Collection Complaints
- CFPB: Medical Debt and Consumer Financial Protection
- CMS Medicare Physician Fee Schedule (2026)
- National Consumer Law Center: Debt Collection Resources