Consumer complaint received 2022-04-29
Company: Credit Bureau Systems, Inc., Paducah, KY Branch
State: KY
Product: Debt collection
Sub-product: Medical debt
Issue: Took or threatened to take negative or legal action
Sub-issue: Threatened to sue you for very old debt

Complaint:
To Whom It May Concern : I recently pulled my credit report to begin the process of credit repair. During this time I reached out to Credit Bureau System collection agency and requested that my medical debt accounts placed with them be verified. After sending one letter to them via certified mail they responded with itemized statements from the hospital that clearly violated my HIPPA rights. I immediately filed a complaint with CFPB about this demanding that Credit Bureau Systems provide me with a signed HIPAA form from the organization they represented with whom I owed the debt to because I do not recall giving authorization to any third party, including a debt collector, the right to obtain any of my private health information. Credit Bureau System stated that they had the right to send those itemized statements because I " requested them ''. I spoke to an attorney about my rights regarding this matter and was advised to file a dispute with the credit agencies ( XXXX, XXXX, XXXX ) directly regarding these accounts. I filed a dispute with XXXX and two weeks later received a letter from Credit Bureau System threatening to sue me over these accounts. I never stated to this company that I didn't own the debt or discussed any type of payment arrangements or refusal to pay the debt. I simply asked that they verify their right to collect the debt and prove that they had my signed permission to have access to such private personal health information. The attorney I have spoke to advised me that a collection agency may have access to the amount owed and general medical billing codes regarding the hospital or physician 's office visit but that these codes are generalized to such things as " ER visit ''. They in no way shape or form should have received an itemized statement listing every diagnosis, procedure, medication, lab or diagnostic test describing my visit. I was further advised that the legal procedure for this is for the collection agency to request that the hospital send the consumer the itemized statements but a collection agency legally should not have this information to begin with, none the less mail the consumer a copy. This is a direct violation of my privacy and I am prepared to file a formal HIPAA violation complaint if Credit Bureau System continues to refuse to provide the authorization form they are legally required to have in order to collect this debt and to have obtained my personal protected health information. I fully intend on contacting and attempting to make payment arrangements with the organizations I owe debt if and when my responsibility for the debt is verified, but I absolutely will not stand for my personal information being accessed by anyone other than my medical providers, especially without my permission or knowledge of them having it. All of the accounts placed with Credit Bureau Systems are to be immediately removed from my credit profile and Credit Bureau System shall cease all contact with me as well as any further attempts to collect these debts from me or I will immediately file a formal HIPAA complaint and will allow my attorney to start a civil law suit. Laws are put in place to protect consumers and simply asking to have a debt verified should not be met with threats of legal action on old debts. 

I fully expect the accounts to be deleted or to be sent a HIPAA authorization release form for each visit/bill by XX/XX/13 or I will proceed with legal action. 

Sincerely, XXXX XXXX

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with explanation