General information about US federal law, not legal advice. Whether a rule applies to your organisation depends on facts this article cannot see, and state law can add to all of it - check specific questions with counsel.
Who the FDCPA actually covers
The Fair Debt Collection Practices Act (15 U.S.C. 1692 and following) and Regulation F, the Consumer Financial Protection Bureau rule that implements it at 12 CFR part 1006, govern debt collectors. Regulation F took effect on November 30, 2021 (CFPB). For a healthcare provider, the statutory meaning of "debt collector" decides almost everything else in this article.
15 U.S.C. 1692a(6) defines a debt collector as a person whose principal business is collecting debts, or who regularly collects debts owed or asserted to be owed to another. It expressly excludes "any officer or employee of a creditor while, in the name of the creditor, collecting debts for such creditor".
In general, that means:
- A provider collecting its own patient balances, in its own name, is a creditor rather than a debt collector, and the FDCPA does not generally reach that activity.
- A collection agency or law firm collecting those balances for the provider is usually a debt collector, and the FDCPA and Regulation F apply to it.
- A provider that collects its own debts under a name other than its own - one that suggests a third party is collecting - is brought back inside the definition by the same paragraph.
State collection laws are a separate question. Their coverage is not necessarily the same as the federal definition, so a provider outside the FDCPA should check its state's law before assuming it is outside every collection statute.
Validation information (Regulation F §1006.34)
A debt collector must give the consumer validation information either in the initial communication or within five days of it, in writing or electronically, or orally in the initial communication (12 CFR 1006.34(a)). Regulation F replaced the short statutory list in 15 U.S.C. 1692g with a specific set of items in §1006.34(c), including:
- The debt collector's name, and the mailing address at which it accepts disputes and requests for original-creditor information
- The consumer's name and mailing address
- The name of the creditor to whom the debt is currently owed
- The account number associated with the debt on the itemization date, or a truncated version of it
- The itemization date, the amount of the debt on that date, an itemization of interest, fees, payments and credits since then, and the current amount
- The date the collector will treat as the end of the validation period, with statements that if the consumer disputes the debt in writing by then, collection stops until the collector sends verification or a copy of a judgment
- A statement that if the consumer asks in writing by that date for the name and address of the original creditor, collection stops until the collector sends it, if different from the current creditor
- A statement that unless the consumer disputes the debt by that date, the collector will assume it is valid
- Prompts the consumer can use to respond: to dispute the debt, or to request the original creditor's name and address
The validation period starts when the information is provided and ends 30 days after the consumer receives it, or is assumed to receive it - the collector may assume receipt at least five days after providing it, excluding weekends and federal holidays (§1006.34(b)(5)).
The itemization date is one of five reference dates: the last statement date, the charge-off date, the last payment date, the transaction date, or the judgment date (§1006.34(b)(3)). For a medical balance, the date of the last patient statement or the date of service is usually the one a collector can actually establish.
Model Form B-1, in appendix B to part 1006, contains the required validation information. A collector that uses it, or a substantially similar version, gets a safe harbor for the information and form requirements (§1006.34(d)(2)).
Communication restrictions (§1006.6)
Times and places. Unless the collector knows of circumstances to the contrary, a time before 8:00 a.m. or after 9:00 p.m. local time at the consumer's location is treated as inconvenient (12 CFR 1006.6(b)(1)). The time zone that matters is the consumer's, not the collector's.
Workplace. A collector must not contact a consumer at work if it knows or has reason to know that the employer prohibits those communications (§1006.6(b)(3)).
Refusal to pay or cease communication. Once a consumer notifies the collector in writing that they refuse to pay or want communication to stop, the collector must stop communicating about that debt, except to say its efforts are ending, or to notify the consumer of a specific remedy it or the creditor may or intends to invoke (§1006.6(c)).
Electronic messages. Every email or text a collector sends about a debt must include a clear and conspicuous, reasonable and simple way to opt out of further electronic messages to that address or number (§1006.6(e)). And a collector must not use a medium of communication the person has asked it not to use (§1006.14(h)).
Prohibited practices (15 U.S.C. 1692d to 1692f)
Harassment ([§1692d](https://www.govinfo.gov/link/uscode/15/1692d?link-type=html))
- No use or threat of violence or other criminal means
- No obscene or profane language
- No causing a telephone to ring repeatedly or continuously with intent to annoy, abuse or harass
- No telephone calls without meaningful disclosure of the caller's identity (also §1006.14(g))
False or misleading representations ([§1692e](https://www.govinfo.gov/link/uscode/15/1692e?link-type=html))
- No false representation of the character, amount or legal status of a debt
- No threat to take any action that cannot legally be taken or is not intended to be taken
- No business name other than the collector's true name
- The initial communication must disclose that the collector is attempting to collect a debt and that information obtained will be used for that purpose
Unfair practices ([§1692f](https://www.govinfo.gov/link/uscode/15/1692f?link-type=html))
- No collecting any amount - interest, fee or charge - unless the agreement creating the debt expressly authorises it or the law permits it
- No communicating about a debt by postcard
- No language or symbol on an envelope other than the collector's address, and a business name only if it does not indicate debt collection
Call frequency (§1006.14(b))
Regulation F turns the statute's ban on calling "repeatedly or continuously" into two rebuttable presumptions, applied per debt: each of a consumer's debts in collection is counted separately (§1006.14(b)(4)).
A collector is presumed to violate the rule if it places a telephone call to a person about a particular debt in excess of either of these frequencies (12 CFR 1006.14(b)(2)):
- More than seven calls within seven consecutive days, or
- Any call within seven consecutive days after having had a telephone conversation with the person about that debt. The day of the conversation is day one of the seven.
A collector that stays within both is presumed to comply. Both presumptions can be rebutted by the facts of a particular case: staying under the numbers is not a guarantee, and exceeding them is not automatically a violation.
Three kinds of call do not count toward the frequencies (§1006.14(b)(3)): calls placed with the person's prior consent, given directly to the collector, within seven days of that consent; calls that do not connect to the dialed number; and calls to certain persons such as the collector's attorney or a consumer reporting agency.
The presumptions are written for telephone calls. Emails, texts and letters are governed by the other rules above, not counted toward the seven.
Credit reporting (§1006.30)
A debt collector must not furnish information about a debt to a consumer reporting agency until it has either spoken to the consumer about the debt in person or by telephone, or mailed or sent a message about it and waited a reasonable period for a notice that it was undeliverable (12 CFR 1006.30(a)). Reporting a debt the patient has never been told about - sometimes called passive collection - is exactly what this prevents.
How the credit bureaus treat medical debt beyond that has changed several times in recent years. Check the current position before relying on any threshold or waiting period.
Disputes and original-creditor requests (§1006.38)
If a consumer disputes the debt in writing within the validation period, the collector must stop collecting the debt, or the disputed part, until it sends verification or a copy of a judgment. If the consumer asks in writing within the period for the original creditor's name and address, collection stops until that is provided (12 CFR 1006.38). During the validation period, nothing the collector does may overshadow or be inconsistent with those rights.
For a healthcare balance, verification usually means
- The itemized statement of services
- The payment and adjustment history, including what insurance paid
- Evidence of the assignment or placement, if the account was placed with an agency
Records (§1006.100)
A debt collector must keep records that evidence compliance or noncompliance from the start of collection activity on a debt until three years after its last collection activity on that debt. If it records calls, each recording must be kept for three years after the call (12 CFR 1006.100). State law, and a provider's own medical-records obligations, may require longer.
For every contact, record
- Date, time and the consumer's local time
- Channel - call, letter, email, text
- Whether a call connected, and whether a conversation about the debt took place
- What was communicated, and the consumer's response
- Any request about times, places or media to avoid
Healthcare-specific considerations
Good faith estimates. Providers and facilities must give uninsured or self-pay patients a good faith estimate of expected charges when they schedule an item or service or ask for one (45 CFR 149.610). A balance far above the estimate is a predictable source of disputes.
Financial assistance. Tax-exempt hospital organizations must meet the financial assistance policy and billing and collections requirements of Internal Revenue Code section 501(r) on a facility-by-facility basis (IRS). Screen for financial assistance before an account moves to more intensive collection, and record that you did.
Building a compliance program
Policies and procedures
- Written collection policies, including when an account is placed with an agency
- Workflow documentation
- Exception handling and escalation
Training
- Initial training for everyone who contacts patients about balances
- Refreshers when the rules or your policies change
- Competency checks
Monitoring
- Call recording and review, where recording is lawful
- Letter, email and text template review
- Complaint tracking and analysis
Agency oversight
- Due diligence before placing accounts
- Contract terms requiring FDCPA and Regulation F compliance
- Complaint investigation
Liability
Under 15 U.S.C. 1692k, a debt collector that fails to comply is liable for:
Individual actions
- Actual damages
- Additional damages the court allows, up to $1,000
- Costs and a reasonable attorney's fee
Class actions
- The individual amounts for named plaintiffs, plus up to the lesser of $500,000 or 1% of net worth of the debt collector for the class
- Costs and a reasonable attorney's fee
A private action must be brought within one year of the violation (§1692k(d)). Public enforcement - by the Federal Trade Commission and, for persons subject to it, the CFPB (§1692l) - is separate.
Compliance checklist
Daily operations:
- Not done: Respect the 8 a.m. to 9 p.m. window in the consumer's time zone
- Not done: Count calls per debt, and note conversations
- Not done: Honour cease-communication and medium-of-communication requests
- Not done: Include the opt-out in every email and text
- Not done: Document every contact
Periodic review:
- Not done: Call monitoring and scoring
- Not done: Complaint analysis
- Not done: Policy review against the current rule text
- Not done: Staff training
- Not done: Agency compliance review
Conclusion
For most providers, the FDCPA is first a question of who is collecting. Your own staff collecting in your own name are generally outside it; the agency you place accounts with is generally inside it, and its conduct reflects on you either way. Know which side of that line each account is on, and hold anyone collecting for you to the rule text, not to a summary of it.
The FDCPA is not the only regime in play. See also HIPAA compliance for collections teams, and the collections practices these rules shape. To talk about how your collections workflow runs today, contact us.
