I have searched about this, but I can't figure out my next move. Basically, the situation is that we used Why Chat's HIPAA letter to pay an OC for a small collection for a medical procedure for my wife in 2002. We received a letter from the OC stating that they not only called the CA to report our payment, but they even sent them a copy of the front and back of our postal money order. Furthermore, they claim that they do not feel that they have committed any HIPAA and/or state privacy violations.

I am under the impression that since we paid the account in full, there is no permitted business purpose for the OC to share any of my wife's information with the collection agency. I guess the next step is to file a HIPAA complaint about that, but it seems that nobody got anywhere with that, at least in what I have found in my searches.

I also feel that it may be a violation of the FDCPA and/or FCRA for the CA to report the item as paid, since we have never contacted the CA for any reason whatsoever and we sure as heck have not paid them. Should we DV? I don't think they are required to respond to a DV for a paid account, but I am a newb.

Anyway, thanks for reading and any help you may be able to provide. I have learned a lot from lurking and reading here and hope to be able to pay it forward someday.

That sucks, sorry to hear it didnt work.

I have read storys that go both ways - YMMV covers just about everything.

Be interested in hearing what the pros recommend for you to do next ...

I feel your pain.

Your next step is to go to WhyChat's site and send the follow up letters. One to each CRA that is reporting the account and a letter to the OC.

ONCE you get those responses back, and it sounds like you will, you file a complaint with the OCR.

And you're right, there is no purpose in reporting your personal info to the CA. Even if the parent company owns the CA.

I'm waiting for two letters to come back from the CRAs still, and its like watching water boil. But once I get those last two, I'll probably be filing the complaint.

Thanks for the responses, coorslight and lil_walnut. While I am sending the follow-up letters tomorrow, I have done some more reading here and have learned a lot about the situation I am in from Subprime's experience last year. I really examined the way that the CA has and is reporting the account, and I found some apparent violations. The account is listed with the following:

Terms: 1 months
Credit Limit: $x.xx (amount removed just in case)
Recent Payment: N/A (not sure about this one, but since they updated it as paid in the last month, shouldn't there be one listed?)

They also have the original creditor listed, which exposes the kind of procedure my wife had.

Anyway, I found posts in which pryan and others mention that the "terms: 1 months" and "credit limit" for a collection account are violations of the FCRA. I have not been able to find those items specifically mentioned in the FCRA or caselaw, however. Does anyone have that information?

My thinking is that my first contact to the CA should either be an ITS or maybe a summons from small claims court. This is now a paid account, and it was for less than $100. I think they have just updated it to paid out of spite. They have nothing to gain by going to court to defend themselves for $2000 worth of damages. I am still not happy about the OC sending a copy of the money order to them, and I will file a complaint with the OCR, but I don't think that will go anywhere.

Am I way off base here? I really just want this stupid little collection to fall off. But seeing as how the OC basically told us to stick it and the CA advised them to do so, now I am thinking I should settle for no less than say a few hundred and a deletion.

Not to sound silly, but what does YMMV stand for? I've seen this on the boards a lot but can't figure it out. Can you tell me what it stands for? Thanks:)

http://www.google.com/search?q=define:YMMV

YMMV: Your milage may vary - i.e. your experience may be different

It stand for for Your Mileage May Vary. It is used as a way to say your experience with what was said maybe different from the person speaking.

FCRA doesn't specifically say "you can't report an accoutn which belongs to another person" either...

FCRA DOES say that information must be complete, accurate, and verifiable...

as for filing a complaint with OCR, they'll likely do what they've done every other time I know of a complaint like this being filed...say that HIPAA allows for sharing the information with business partners for payment purposes...which paying the OC IS...

Thanks, pryan. I sent out the follow-up letters today to the OC and the CRAs. Even though I don't expect anything to come of it, I will still file the OCR report if they verify.

About the CA--would it be ok to send an ITS and follow through with filing in small claims five days after they receive the ITS, or should I send a DV first. I see mention on here about sending DV two or three times to show good faith effort when filing suit, but I would rather sue them while they are still in violation. If they happen to change their reporting to not include the violations I mentioned above, would I still have a leg to stand on in court by providing previous credit reports as evidence of their violations?

The problem is if the CA is reporting it. If you pay the OC and endorsed it, and IF the CRA contacts the CA who contacts the OC for verification AND it comes back verified, then you have a case.

Once the OC has been paid (hence the reason you pay the OC with the endorsements) there is no permissible purpose in that information being shared with the CA which in turn should cause the CA not to be able to verify the account.

I disagree with the above (and so does OCR)...unless, of course, you'd rather have the CA required to report it as "unpaid"?

Pryan,

That was my understanding based on all the reading I've done on WhyChat's website.

If that's the case then why does anything get removed?

Well, I sent out the follow-up letters, but the OC has basically told me in their response to the first letter that they don't think they have committed any HIPAA violations and that the CA is reporting it as paid. So I am sure that they will verify, and as pryan said, the OCR has repeatedly said that that was permissible. I still plan on filing the OCR complaint after they verify, just as a formality and also because I am using Subprime's approach of just being a major PITA until they decide that it is not worth continuing to deal with a paid account.

lil-walnut, the grounds I think I have for suing the CA are the way they are reporting that there is a credit limit and terms: 1 months on my wife's report. And the reason that I think many accounts get removed are because the OCs don't want to deal with HIPAA complaints at all, even if they feel they are compliant, and most OCs also really just want to get paid and probably don't want to poison their patients' credit reports for 7 years. I don't know if this OC was offended by our HIPAA letter or just doesn't care if we or any of our friends ever use their services again, but they seem intent on poisoning my wife's credit report with a paid account that was originally less than $100.

Does anybody think I should DV the CA before sending the ITS? Since it is paid, should I send a nutcase? Or just go straight to the ITS?

Thanks for the advice and support.

Just wanted to follow up. In trying to figure out what to do, I decided to send a copy of the follow up letters to the actual MD at their office. The OC that I had been dealing with was a billing company that handles accounts for many smaller practices. Anyway, I included a little note informing the physician of the way we were being treated by the billing company and that their disregard for HIPAA regulations could put the Dr. at risk of sanctions from the OCR.

Long story short, I received a new letter yesterday from the same person who previously told us no dice. They say that while they are admitting no violations at all, they did request that the CA expunge all records of this TL from my wife's reports. It is not off yet, but I am expecting it will be in a few days. WOOHOO!!!!!!!

Thanks CB!

Absolutely correct, furnishing and reporting accurate and complete information isn't a violation of anything. Glad the additional presure seems to have worked for you but thats the risk with the hipaa series (paid collection stuck on report) versus pursing validation first.