They are not, but he is protected by his corporation rights. If it's a legally registered business and the loan is specifically under that business, they cannot collect from the individual (guarantor) unless they have a judgement obtained on the business, they cannot harass the individual behind the loan.
This is tricky wording here. Technically, no, they cannot "harass" as defined by Fair Collections Act, but they ARE allowed to contact neighbors, former places of employment, relatives, etc. If you put in a cease and desist, that totally changes the ballgame and the collection agency would have only one attempt to collect the debt which in most cases they use to serve the individual by sheriff, certified mail, publication, etc. if trying obtaining judgement against them. Also, the business MUST be incorporated to have any sort of protection (collection agency can only go after the companies assets). But, if this is Jo Shmo's DBA business the collection agency can still come after you, the owner.
Your best bet is to get a cease and desist to limit their attempts at collecting the account to 1. Also, pay your bills and you wont have to deal with it.