CFPB Medical Debt Rule: What Changed, What Was Overturned, and How to Remove Medical Debt from Your Credit Report (2026 Guide)

In January 2025, the Consumer Financial Protection Bureau (CFPB) finalized a rule that would have removed virtually all medical debt from American credit reports. Six months later, a federal court vacated that rule. If you have medical debt on your credit report right now, understanding exactly what happened -- what was removed, what was overturned, and what rights you still have -- is the difference between taking effective action and waiting for a protection that no longer exists in the form you may have heard about.

This guide covers everything: the 2022-2023 changes that are still in effect, the January 2025 rule and why it was overturned in July 2025, the 15 states that passed their own laws, how different credit scoring models treat medical debt, the HIPAA dispute angle competitors do not explain, and the complete step-by-step process for removing medical debt that should not be on your report right now.

Written by Joeziel Vazquez, FCRA Certified Professional (FCRA-CP), Board Certified Credit Consultant (BCCC), and founder of Credlocity Business Group LLC -- 17 years of credit repair, 79,000+ clients served since 2008.

What the 2022-2023 Bureau Changes Already Did (And Still Do)

Before the CFPB rule, before any court ruling -- three specific changes made by the credit bureaus themselves in 2022 and 2023 are fully in effect and will remain so regardless of any regulatory outcome:

• July 2022 -- Paid medical collections removed: Equifax, Experian, and TransUnion announced they would delete all paid medical collection accounts from credit reports. Previously, a paid medical bill could stay on your report for up to 7 years after payment. That ended in 2022.

• April 2023 -- Medical debt under $500 removed: All three bureaus removed medical collection accounts under $500 entirely -- whether paid or unpaid. If your medical collection was for less than $500, it should have disappeared from all three reports by April 2023.

• 2023 -- 12-month grace period extended: The time before an unpaid medical collection can appear on your credit report was extended from 6 months to 12 months. This gives consumers more time to work with insurance, billing departments, and hospitals before a collection hits their report.

These changes are independent of any CFPB rulemaking. They were made voluntarily by the bureaus themselves and are permanent. If you have any paid medical collection or any medical collection under $500 still appearing on your report, that is an error you can dispute today under FCRA Section 611.

The January 2025 CFPB Rule: What It Would Have Done

On January 7, 2025, the CFPB finalized a rule that would have gone significantly further than the voluntary bureau changes. The rule would have:

• Prohibited credit reporting agencies from including ANY medical debt in consumer credit reports -- regardless of amount, whether paid or unpaid.

• Prohibited lenders from using medical debt information in credit decisions even if they obtained it through other means.

• Affected approximately 15 million Americans who had an estimated $49 billion in medical debt on their credit reports.

• Been projected to raise the credit scores of affected consumers by an average of 20+ points.

The CFPB's rationale: research consistently shows that medical debt is a poor predictor of creditworthiness compared to other types of debt, because medical debt often results from unexpected events (illness, accident, emergency) rather than from patterns of financial irresponsibility. Using it to gatekeep credit access was producing unfair outcomes without improving lender accuracy.

Why a Federal Court Overturned the CFPB Rule in July 2025

In July 2025, a federal court vacated the January 2025 CFPB rule. The court's decision rested on two primary legal grounds:

1. Exceeded CFPB authority: The court found that the CFPB's authority under the Fair Credit Reporting Act (FCRA) did not extend to the sweeping prohibition the rule attempted. The FCRA governs what information can be reported and for how long -- but the court found that completely banning an entire category of accurate debt information went beyond what Congress authorized the CFPB to do.

2. FCRA preemption: Federal FCRA law preempts state credit reporting laws in many contexts -- but the court applied similar preemption logic to the CFPB's own attempt to restrict reporting beyond what the FCRA itself provides. The ruling created significant tension in the regulatory space that Congress may need to resolve.

The practical result: unpaid medical debt over $500 can still be reported to credit bureaus. The voluntary changes from 2022-2023 remain intact. And as of 2026, the regulatory future of medical debt credit reporting at the federal level is uncertain -- which is exactly why your existing FCRA dispute rights are more important than ever.

15 States with Their Own Medical Debt Credit Reporting Laws

While the federal CFPB rule was overturned, a wave of state-level legislation has created a patchwork of stronger protections for consumers in certain states. If you live in one of these states, you may have rights that go beyond federal FCRA protections:

If you are in one of these states, contact your state attorney general's office or an FCRA-certified specialist to understand the specific protections available. State laws can provide grounds for disputes that go beyond what federal FCRA Section 611 alone would allow.

Which Medical Bills Can Still Appear on Your Credit Report in 2026

With the federal rule overturned and voluntary changes intact, here is the current framework:

How Medical Debt Affects Your Credit Score by Scoring Model

Not all credit scores treat medical debt the same way. This matters because the score a lender pulls may be different from the one you see on a monitoring app:

• FICO Score 8 (most widely used by mortgage lenders, auto lenders, and credit card issuers) treated medical and non-medical collections identically before the 2022-2023 changes. With those changes removing most medical collections from reports, the question is now largely moot for removed items. Any remaining medical collection over $500 still impacts FICO 8 like any other collection.

• FICO Score 9 and FICO Score 10 already weighted medical collections less severely than other types of debt -- before any rule or bureau change. These models recognized the involuntary nature of medical debt. However, only a minority of lenders have adopted these newer models.

• VantageScore 3.0 and 4.0 treat medical collections more leniently than FICO 8. VantageScore 4.0 gives no weight to medical collections in collections. If your score is pulled under VantageScore, your medical debt may have less impact than under FICO 8.

• Mortgage-specific scores (FICO 2, 4, and 5 -- required for GSE-backed loans) are older models that may treat collections more harshly. If you are applying for a conventional or FHA mortgage, the tri-merge credit report uses these older FICO models.

The practical takeaway: even if your consumer-facing credit score app shows a relatively strong score because it uses VantageScore, a mortgage lender using FICO 2/4/5 may see a very different number when medical collections are present. This is one reason to check all three bureau reports and understand which scoring model your specific lender uses before applying.

How to Check Your Credit Report for Medical Debt Right Now

Step 1: Go to AnnualCreditReport.com -- the only federally authorized free report source under FCRA Section 1681j. Pull all three reports: Equifax, Experian, and TransUnion. Do not rely on a single bureau or credit monitoring app -- medical debt may appear on one or two bureaus but not all three, and each bureau must be disputed separately.

Step 2: Navigate to the Collections or Negative Accounts section on each report. Search for any entry with these words in the creditor name: hospital, medical, physician, healthcare, health system, clinic, ambulance, radiology, pathology, anesthesiology, emergency, urgent care, or any collection agency name paired with a medical provider.

Step 3: For each medical collection entry, note:

• Is it paid or unpaid? (If paid -- it should be removed. Dispute immediately.)

• What is the original balance? (If under $500 -- it should be removed. Dispute immediately.)

• What is the date of first delinquency? (This starts the 7-year reporting clock -- errors in this date are extremely common and can be disputed.)

• Who is the current owner? (Original provider, billing company, collection agency, or debt buyer? Each transfer creates documentation gaps.)

• Which bureaus show it? (Each bureau that shows it requires a separate dispute.)

The HIPAA Angle: Using Privacy Law as a Dispute Tool for Medical Collections

This is the section most credit repair articles skip entirely. The Health Insurance Portability and Accountability Act (HIPAA) gives consumers rights over their protected health information (PHI) that can create additional grounds for disputing medical collections -- beyond what FCRA Section 611 alone provides.

Here is how it applies to credit reporting:

When a hospital, clinic, or physician sends your account to a collection agency, they are sharing your health information -- the nature of your treatment, the services rendered, the dates of service. Under HIPAA's Privacy Rule (45 CFR Part 164), this sharing is only permitted under specific circumstances, including for payment purposes. However, the chain of custody for medical debt -- from provider to billing company to collection agency to debt buyer -- often involves sharing that was not properly authorized at each step.

The dispute argument: if the medical provider could not legally share your protected health information with the collector, the collector obtained the underlying information improperly and therefore cannot accurately report the debt to credit bureaus. This argument is strongest when:

• The debt has been sold to a third-party debt buyer with no direct relationship to your healthcare provider

• The collection agency cannot produce a HIPAA-compliant authorization showing they had the right to receive your medical information

• The account has changed hands multiple times and documentation is thin

A HIPAA-based dispute letter requests that the collector prove they received your PHI through a HIPAA-compliant process -- and if they cannot, the debt is unverifiable and must be removed. This is not a guarantee of removal, but it is a powerful supplemental argument when combined with a standard FCRA Section 611 bureau dispute and FDCPA Section 1692g validation demand. See our Medical Debt on Your Credit Report guide for more detail on how our team uses HIPAA in the dispute process.

Your Complete FCRA Dispute Process for Medical Debt

Under FCRA Section 611, you have the right to dispute any information that is inaccurate, incomplete, or that cannot be verified. Bureaus must investigate within 30 days and delete anything they cannot verify. Here is the complete process:

Step 1: Send a Debt Validation Letter to the Collector (FDCPA Section 1692g)

Send a certified mail letter to the collection agency demanding validation of the debt. They must provide: proof the debt is valid, proof they have the right to collect it, and documentation of the original creditor and account. Until they respond, they must cease collection activity. If they cannot validate -- which is common with old or resold medical debt -- the item must be removed. Use our free dispute letter templates.

Step 2: File FCRA Section 611 Disputes with All Three Bureaus

Send written disputes via certified mail with return receipt requested to each bureau that shows the medical collection. Do not dispute online -- the online portals restrict your dispute rights and make it easier for bureaus to close disputes without fully investigating. Use specific dispute language:

• For paid collections: "This medical collection was paid and should have been removed under the credit bureaus' voluntary removal policy effective July 2022."

• For under-$500 collections: "This medical collection is under $500 and should have been removed under the bureaus' April 2023 voluntary removal policy."

• For accuracy errors: "The date of first delinquency is incorrect. The balance shown does not match the original amount. This account is duplicated under two different collection agency names."

Step 3: Escalate to Furnisher Dispute (FCRA Section 1681s-2(b))

If a bureau returns "verified" on your dispute, do not stop. File a direct dispute with the original furnisher (the hospital, clinic, or original creditor) under FCRA Section 1681s-2(b). The furnisher now bears legal liability for the accuracy of what it reports. This is the step most consumers skip -- and it provides the greatest legal leverage because furnishers face direct liability for FCRA violations, not just bureau-level investigations.

Step 4: File a CFPB Complaint if Violations Occur

If the bureau or collector violates your rights, file a complaint at consumerfinance.gov. The CFPB supervises all three major bureaus and has enforcement authority. A complaint on the record also creates documentation that strengthens any subsequent legal action.

Comparing Your Four Medical Debt Removal Options

Most articles list these separately. Here they are compared side by side so you can choose the right approach for your situation:

At Credlocity, our FCRA-certified team runs all applicable methods simultaneously for each account -- we do not limit clients to one approach. Our Collection Removal service addresses all collection types using FDCPA validation, FCRA disputes, furnisher escalations, and HIPAA analysis as applicable.

After Removal: How to Verify the Deletion Stuck and Monitor for Re-Reporting

Successful removal is not the end of the process. Here is what to do after a medical collection is deleted:

1. Pull all three reports within 5 days of the deletion notice. The bureau that investigated should have updated its report -- but the other two may not have been notified. Each bureau must be verified separately. Do not assume a deletion at Experian means Equifax and TransUnion also removed it.

2. Screenshot and date every updated report. FCRA Section 1681i(a)(5)(B) requires bureaus to notify you in writing before re-inserting a deleted item. If it reappears without that notice, you have documented proof of a willful FCRA violation.

3. Set a calendar reminder to recheck in 60 and 90 days. Re-insertion most often happens when the original furnisher runs its monthly data update and re-sends the account information to the bureau without realizing it was deleted. Catching this early preserves your legal rights (the 2-year statute of limitations on FCRA violations starts from the date you discovered the violation -- so early detection matters).

4. If it reappears without written notice -- contact an FCRA attorney immediately. This is a willful violation under FCRA Section 1681n. You are entitled to actual damages, statutory damages of $100-$1,000 per violation, punitive damages, and attorney's fees. Many FCRA attorneys handle re-insertion cases on contingency because defendants pay fees when consumers prevail.

How Medical Debt Affects Your Credit Score: Before and After Removal

Understanding the credit score impact helps you prioritize which accounts to address first:

• A single medical collection in collections can drop a score by 60-100+ points under FICO Score 8, depending on the age of the collection and the rest of the credit profile. The impact is largest when the collection is recent (within 2 years) and when the rest of the profile is otherwise clean.

• Multiple medical collections do not necessarily drop the score proportionally more -- FICO scoring diminishes the marginal impact of each additional collection after the first. But each one is still negative, and removing all of them compounds the score gain.

• Score increases after removal vary by profile. In Credlocity's client base, consumers with nothing but medical collections removed have seen 30-80 point increases in 30-60 days. Consumers with a mix of medical and non-medical collections see smaller gains from medical removal alone.

• Timing matters for mortgage applications. For a mortgage, your score is locked in at the time of the credit pull. A successful medical collection removal in week 1 can be reflected on the report within one billing cycle -- or through rapid rescore if your lender offers it (3-5 day update vs. 30 days).

Negotiating Directly with Medical Providers Before Collections Occur

The most powerful time to act on medical debt is before it reaches a collection agency. Once it is in collections, your options narrow. Before collections:

• Request an itemized bill immediately. Medical billing errors are common -- coding errors, duplicate charges, services billed but not rendered, insurance payments not properly credited. An itemized bill review before payment can eliminate errors that would otherwise become collection items.

• Apply for charity care or financial assistance. Nearly every nonprofit hospital is required by IRS rules to offer charity care programs to qualify for tax-exempt status. These programs can reduce or eliminate medical debt entirely for qualifying income levels. Ask the billing department for a financial assistance application before paying or negotiating.

• Negotiate a payment plan directly with the provider. Most hospitals and large physician groups have interest-free payment plan programs. A payment plan in place before the 12-month grace period expires prevents the account from ever going to collections and appearing on your report.

• Appeal insurance denials. A significant percentage of insurance denials are overturned on appeal. Before paying out-of-pocket for a denied claim, pursue the internal and external appeal processes -- the time invested can eliminate the debt entirely.

What Joeziel Vazquez Has Seen in 17 Years of Medical Debt Cases

In 79,000+ client cases since 2008, medical debt has been one of the most consistently successful dispute categories. Three patterns explain why:

1. Billing errors are the norm, not the exception. Medical billing is among the most error-prone systems in consumer finance. Studies consistently show error rates of 30-80% in medical bills. Errors in how a bill was coded, processed by insurance, credited after partial payment, or transmitted to collections are disputable under FCRA Section 611 regardless of any special rule.

2. The chain of custody is usually broken. Medical debt changes hands -- from provider to hospital billing department to collection agency to debt buyer. Each transfer creates documentation gaps. An FDCPA debt validation request frequently exposes that the current collector cannot prove ownership of the original debt or the accuracy of the amount. Without documentation, the item cannot be verified and must be removed.

3. HIPAA adds leverage that most collectors do not anticipate. Most debt collectors handling medical accounts are not prepared for a HIPAA-based dispute. When they receive one, they must produce authorization documentation that many cannot locate -- which creates additional grounds for deletion beyond what a standard FCRA dispute would achieve.

For a complete guide to the dispute process and medical debt options, see our Medical Debt on Your Credit Report guide, our Credit Bureau Dispute Guide, and our Complete FCRA Guide.

If you have medical collections alongside other negative items, our Collection Removal service addresses all collection types simultaneously. Start with a free credit analysis at credlocity.com/intake.

Frequently Asked Questions About the CFPB Medical Debt Rule

Was the CFPB medical debt credit reporting rule overturned?

Yes -- a federal court vacated the CFPB's January 2025 rule in July 2025. The court ruled that the CFPB had exceeded its authority under the Fair Credit Reporting Act and that certain aspects of the rule were preempted by existing federal law. This means the sweeping ban on ALL medical debt in credit reports did not take effect. However, this court ruling does NOT undo the voluntary changes the three major bureaus already made in 2022-2023: paid medical collections are still removed, medical debt under $500 is still removed, and the 12-month grace period before collections appear on your report is still in effect. Those protections are permanent regardless of any CFPB rulemaking. Additionally, 15 states have passed their own laws restricting medical debt credit reporting -- if you live in one of those states, you may have stronger protections than federal law provides.

Does the court ruling mean medical debt is back on credit reports?

No -- the voluntary bureau changes from 2022-2023 are completely separate from the CFPB rule and were not affected by the court ruling. The three bureaus made these changes on their own initiative before the CFPB rule was finalized, and they remain in effect: paid medical collections are removed regardless of the balance, unpaid medical collections under $500 are removed, and medical debt has a 12-month grace period before appearing on reports. What the court ruling blocked was the expansion of these protections to ALL medical debt regardless of amount or payment status. Unpaid medical debt over $500 can still appear on credit reports under the current framework -- which is why FCRA dispute rights and FDCPA validation rights remain important tools for consumers with those accounts.

Which states have their own medical debt credit reporting laws?

As of 2026, approximately 15 states have enacted laws providing additional protection against medical debt credit reporting beyond what federal law requires. States with notable protections include: Colorado (prohibits medical debt credit reporting entirely), New York (restricts medical debt collection and credit reporting), New Jersey (medical debt credit reporting restrictions), Maryland (medical debt protections for consumers), Illinois (additional protections for medical debt consumers), Minnesota (medical debt credit reporting rules), Nevada (medical debt collection restrictions), Delaware (effective October 2025 -- medical debt credit reporting restrictions), Washington, Oregon, Connecticut, and New Mexico (various protections). If you are in a state with its own law, you may be able to dispute medical debt that would otherwise remain reportable under federal law. Contact your state attorney general's office or an FCRA attorney to understand your specific state rights.

Can I use HIPAA to remove medical collections from my credit report?

HIPAA can be a powerful supplemental tool alongside FCRA disputes -- but it works differently than an FCRA Section 611 dispute. HIPAA restricts who can access and share your protected health information (PHI). When a medical provider shares your PHI with a debt collector without proper authorization, that may constitute a HIPAA violation. The dispute argument is: if the medical provider could not legally share your health information with the collector, the collector cannot legally report the debt to credit bureaus because the underlying information was improperly transmitted. This is not a guaranteed removal strategy -- the HIPAA-credit report connection is a legal gray area -- but it adds a layer of dispute grounds, particularly for accounts where the information changed hands multiple times (from provider to billing company to collection agency to debt buyer). At Credlocity, our FCRA-certified team evaluates each account's chain of custody to identify where HIPAA arguments may apply alongside standard FCRA dispute rights.

What if a medical collection keeps reappearing on my credit report after removal?

Re-insertion of a previously deleted item is one of the most serious FCRA violations. Under FCRA Section 1681i(a)(5)(B), a credit bureau may only re-insert a previously deleted item if the furnisher certifies the accuracy of the information AND the bureau notifies the consumer in writing within 5 business days. If a medical collection reappears without this notice, that is a willful FCRA violation under Section 1681n, which entitles you to actual damages, statutory damages of $100 to $1,000 per violation, punitive damages, and attorney's fees. Document the deletion and re-appearance with screenshots and dated credit report pulls. Contact an FCRA attorney -- many handle these cases on contingency because the defendant must pay fees if you prevail.

Bottom line: The CFPB's sweeping federal rule was overturned in July 2025 -- but the 2022-2023 voluntary bureau changes are permanent, 15 states have their own protections, and your FCRA dispute rights exist independently of any regulatory action. If medical debt is on your report right now, you have options. Start by pulling all three reports at AnnualCreditReport.com, then identify every item that should have been removed under the existing rules. Many medical collections can be disputed and removed within 30-60 days. Start your free credit analysis today.