How is this not a complete violation of HIPAA?
Are they working around it by having very general HIPAA release forms?
https://www.hhs.gov/hipaa/for-professionals/faq/268/does-the...
> The Privacy Rule permits covered entities to continue to use the services of debt collection agencies. Debt collection is recognized as a payment activity within the “payment” definition. See the definition of “payment” at 45 CFR 164.501. Through a business associate arrangement, the covered entity may engage a debt collection agency to perform this function on its behalf. Disclosures to collection agencies are governed by other provisions of the Privacy Rule, such as the business associate and minimum necessary requirements.