Consumer complaint received 2021-05-18 00:00:00
Product: Debt collection — Medical debt
Issue: Attempts to collect debt not owed — Debt was result of identity theft
Company: KLS Financial Services, Inc
State: AZ

Complaint narrative:
I am a victim of identity theft. The tradeline, which appears on my credit report from KLS FINANCIAL SERVICES last reported XX/XX/XXXX in the amount of {$140.00} does not relate to any transaction ( s ) credit account I have ever had. It is the result of identity theft. I received a copy of my credit reports and discovered this trade line on my credit report. I did not authorize this account or transaction. I did not apply for any credit with this company and have no existing accounts with. Please delete this information from my credit report, pursuant to section 605B of the Fair Credit Reporting Act. I have contacted both KLS FINANCIAL SERVICES individually and have not received any reply back In addition, the HIPAA and Arizonas Medical Privacy Statutes and the penalty provisions of the ARRA section D, privacy provisions, the penalty rules of the HITECH Act as issued XX/XX/XXXX and the Omnibus Final Rule effective XX/XX/XXXX and the FACT Act final rules effective XX/XX/XXXX, XXXX.are in effect in this situation. 
The Privacy Rules prohibits a covered entity from using or disclosing an individual 's protected health information ( " PHI '' ) unless specifically authorized by the individual or otherwise allowed under the Privacy Rules.

PHI encompasses substantially all " individually identifiable health information '' that is transmitted or maintained in any medium. " Individually identifiable health information '' includes health information that is created or received by a health care provider, health plan, employer, or health care clearinghouse, and that relates to an individual 's physical or mental health or condition, including information related to an individual 's care or the PAYMENT for such care. 

KLS FINANCIAL SERVICES, is not in compliance with HIPAA, or Arizonas Privacy Act, and any subsequent reporting of this account on my credit reports to XXXX, XXXX and XXXX  is a clear violation of Public Law 104-191 ( " HIPAA '' ) since there can be no permissible business purpose in divulging protected health information to anyone on an account once there is no longer any payment due.In addition the new Omnibus Final Rule states : when patients pay out of pocket in full, they can instruct their provider to refrain from sharing information.This letter serves as that instruction You are required under the FCRA and FACTA to accurately report the status of any account to the credit bureaus, and you are prohibited under the HIPAA and State privacy regulations from doing so on a PAID account, as there is no longer any permitted business purpose.

You are also advised that you may be in violation of the Notice of Proposed Procedures for Charitable Hospitals to Correct and Disclose Failures to Meet Section 501 ( r ) of the Affordable Care Act.

Please respond, in writing within 10 days that you are processing this request.

I am reserving the right, to take appropriate legal and civil action including reporting to any applicable regulatory authorities any lack of cooperation or compliance with this request.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation