--- title: "Selling Healthcare Receivables: A Compliance Review" canonical: "https://searchreceivables.com/blog/the-medical-debt-mandate-a-protocol-for-selling-healthcare-receivables" date: "2025-11-13" lastUpdated: "2026-10-01" author: "Jeffery Hartman" categories: ["ARM Industry", "Search Receivables", "Accounts Receivables", "Medical Debt", "debt repayment plans"] --- # Selling Healthcare Receivables: A Compliance Review > Healthcare receivables require account-level review before a sale or collection placement because privacy, financial-assistance, billing, and consumer-protection obligations can affect the transaction. This guide explains a practical review sequence and the federal sources that frame key HIPAA, hospital, collection, and credit-reporting considerations. Selling healthcare receivables requires more than assigning a balance to a new owner. Before a sale or collection placement, the parties should reconcile the account, identify any remaining payer or financial-assistance issues, define the permitted use of health information, and apply the collection and credit-reporting rules that fit the transaction and jurisdiction. ## Why healthcare receivables need a separate review A healthcare receivable can refer to different obligations. A payer receivable is an amount expected from an insurer or other payer; a patient-responsibility balance is an amount billed to the individual after the provider’s billing and adjudication process. A portfolio can also contain disputed charges, adjustments, payment-plan activity, or accounts that may be eligible for financial assistance. Those distinctions matter to documentation, valuation, transfer terms, and communications. Face value alone is therefore not a reliable measure of a portfolio’s practical value. A prospective seller or buyer should evaluate the account-level support for the balance and the operational obligations that continue after the transfer. The review should be performed without assuming that every account is collectible or that a completed sale resolves the provider’s responsibilities. ## HIPAA: match the information flow to the legal relationship The U.S. Department of Health and Human Services (HHS) recognizes debt collection as a payment activity and says a covered entity may engage a collection agency through a business-associate arrangement. HHS also explains that disclosures to collection agencies are governed by the business-associate and minimum-necessary requirements. See [HHS guidance on providers and debt collection agencies](https://www.hhs.gov/hipaa/for-professionals/faq/does-the-hipaa-privacy-rule-prevent-health-care-providers-from-using-debt-collection-agencies/index.html). When an entity performs services for a covered entity and creates, receives, maintains, or transmits protected health information (PHI) on its behalf, it may be a business associate. HHS states that a covered entity must obtain satisfactory written assurances in a business associate agreement (BAA), and that the agreement must address permitted uses and disclosures and safeguards. See [HHS business-associate guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html). - Classify the data. Identify what information is PHI, where it will be stored, and which people or service providers can access it. - Map the roles. A BAA is a required safeguard when the relationship is a business-associate relationship; it is not a substitute for analyzing the structure of a sale, assignment, servicing arrangement, or later disclosure. - Limit and protect access. Build the transfer file, access controls, vendor oversight, and incident-response obligations around the minimum information needed for the authorized work. HIPAA analysis is fact-specific. The identity of the provider, seller, purchaser, servicer, subcontractor, and the purposes for which data are used can change the result. Counsel or an experienced privacy professional should review the proposed data flow before files are exchanged. ## Account-level diligence before a sale or placement A workable diligence file should let the parties trace each balance from the service and billing records to the proposed transfer. At a minimum, the review should address: - Ownership and authority: the current creditor, transfer history, contractual restrictions, and authority to place, assign, or sell the account. - Balance support: service and billing dates, payments, credits, adjustments, payer activity, and the records needed to explain the current amount. - Open patient issues: disputes, insurance coordination, payment arrangements, bankruptcy, deceased-patient handling, and any documented request for financial assistance. - Financial-assistance controls: whether the provider is a hospital facility subject to Internal Revenue Code section 501(r), and if so, whether its financial-assistance policy and collection process affect the account. For hospital facilities subject to section 501(r), the IRS says selling an individual’s debt generally is an extraordinary collection action (ECA). The IRS also describes a limited exception for a debt sale covered by a legally binding agreement with specified protections, including no ECAs by the purchaser, an interest limit, recallability when a person is found eligible for financial assistance, and protections against paying more than the person’s approved responsibility. A sale that does not satisfy those conditions is an ECA and requires reasonable efforts to determine financial-assistance eligibility first. See the [IRS section 501(r)(6) billing and collections guidance](https://www.irs.gov/charities-non-profits/billing-and-collections-section-501r6). ## Collection controls should account for consumer protections Medical debt does not eliminate consumer protections. When an entity is a debt collector covered by the federal Fair Debt Collection Practices Act and Regulation F, the current federal rule generally requires validation information in the initial communication or within five days. The required information includes the collector’s contact information, the current creditor, an itemization date, the amount on that date, and the current amount. The current text is available at [CFPB Regulation F section 1006.34](https://www.consumerfinance.gov/rules-policy/regulations/1006/34/). Before any post-transfer collection activity, operators should have a process to investigate disputes, correct the amount when support does not match the account record, and route insurance or financial-assistance issues back to the appropriate party. The CFPB notes that a collector cannot falsely represent the character, amount, or legal status of a debt, and explains that medical bills exceeding amounts permitted by the No Surprises Act may raise federal-law concerns. See [CFPB guidance on medical bills in collections and credit reporting](https://www.consumerfinance.gov/ask-cfpb/what-should-i-know-about-debt-collection-and-credit-reporting-if-my-medical-bill-was-sent-to-collections-en-2122/). Federal coverage is not the whole analysis. State medical-debt protections, collection licensing, limitation periods, hospital policies, and other rules may impose additional requirements. Those issues should be examined for the governing state and the account facts rather than treated as a uniform national rule. ## Credit reporting: do not price from an assumed nationwide ban The CFPB issued a medical-debt credit-reporting rule in January 2025, but the U.S. District Court for the Eastern District of Texas set aside and vacated the rule in its entirety on July 11, 2025. See the court’s [final judgment in Cornerstone Credit Union League v. CFPB ](https://storage.courtlistener.com/recap/gov.uscourts.txed.235173/gov.uscourts.txed.235173.53.0.pdf). The CFPB’s current rule page likewise says the materials are for reference only after the vacatur. See [the CFPB’s Regulation V rule page](https://www.consumerfinance.gov/rules-policy/final-rules/prohibition-on-creditors-and-consumer-reporting-agencies-concerning-medical-information-regulation-v/). Accordingly, a portfolio model should not treat that vacated 2025 rule as an active nationwide federal prohibition. This does not answer whether a specific account can be furnished to a consumer reporting agency: state law, reporting-agency policies, account accuracy, dispute status, and the applicable Fair Credit Reporting Act requirements remain relevant. Confirm current requirements before making a reporting decision or assigning a value to reporting as a collection tool. ## A practical transfer sequence - Separate payer balances from patient-responsibility balances and exclude accounts outside the proposed scope. - Reconcile each account’s amount, ownership, service dates, payments, adjustments, and open insurance or assistance issues. - Assess whether the provider’s financial-assistance policy and section 501(r), if applicable, limit a sale or require particular contract terms. - Document privacy roles, the permitted data set, security expectations, BAA requirements where applicable, and downstream-vendor controls. - Set collection, validation, dispute, and escalation procedures before consumer contact begins. - Use transaction documents that allocate record access, account recalls, error correction, cooperation, audits, and compliance responsibilities. For related portfolio-planning context, see [selling patient receivables in a dental-practice setting](/blog/the-dental-practice-liquidity-event-selling-patient-receivables) and [portfolio-value considerations for sellers](/blog/the-seller-s-protocol-a-mandate-for-maximizing-portfolio-value). This article is general educational information, not legal advice or a substitute for transaction-specific compliance review. ## Frequently asked questions ### Can accounts receivable be sold? Yes, receivables can be transferred in many business settings, but a healthcare account needs account-specific review first. The parties should confirm ownership, contract terms, the supported balance, privacy obligations, financial-assistance issues, and collection rules. For hospital facilities subject to section 501(r), the IRS describes specific conditions that can affect a medical-debt sale. ### What is a debt buyer? A debt buyer is an entity that acquires ownership of debt and may collect it itself or use a servicer or collection agency. The federal and state rules that apply depend on the entity’s role and the account facts. When Regulation F applies, a validation notice must identify the current creditor and provide other required account information. --- *Original canonical URL: [https://searchreceivables.com/blog/the-medical-debt-mandate-a-protocol-for-selling-healthcare-receivables](https://searchreceivables.com/blog/the-medical-debt-mandate-a-protocol-for-selling-healthcare-receivables)*