The CFPB's effort to ban medical debt from credit reports ended without a surviving rule. The Bureau finalized its rule in January 2025. A federal court vacated it six months later, with the CFPB itself joining the plaintiffs in requesting vacatur. The Bureau has since stated it will not reissue related guidance.
What remains operative is a two-part regime: the voluntary changes Equifax, Experian, and TransUnion made in 2022 and 2023, which removed the majority of medical collection tradelines from consumer credit reports, and an expanding patchwork of state laws, with more than fifteen states now actively restricting or prohibiting medical debt reporting.
For collection agencies handling medical debt, the federal landscape changed twice in the span of six months and then settled. This article walks through the rulemaking history, the post-vacatur landscape, and what agencies should actually do given where the regulatory ground stands today.
The medical debt rulemaking moved through three phases in roughly thirteen months. The proposal and final rule shaped industry expectations; the vacatur reset them.
The CFPB issued the proposed rule on June 11, 2024. The proposal would have amended Regulation V (the Bureau's implementation of the Fair Credit Reporting Act) to prohibit creditors from considering medical debt in credit decisions and prohibit consumer reporting agencies from including medical debt information on credit reports.
The Bureau's framing positioned medical debt as qualitatively different from other consumer debt: arising from emergencies and unavoidable health costs. It characterized existing reporting practices as enabling "coercive collection," where the threat of negative credit reporting pressured consumers into payment.
The proposal would have removed the existing exception under the Fair Credit Reporting Act that allowed creditors to consider medical debt information in credit decisions. The Bureau opened a public comment period and received submissions from healthcare providers, credit unions, debt collectors, consumer advocates, and trade associations.
The CFPB finalized the rule on January 7, 2025, under the title "Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information." The rule's effective date was set for March 17, 2025.
The substantive provisions tracked the proposal closely. The final rule eliminated the regulatory exception that had previously allowed lenders to consider medical debt when determining creditworthiness and prohibited consumer reporting agencies from including medical debt information on consumer credit reports. Coded medical debt information specifically was within the rule's prohibition.
The Bureau projected the rule would affect approximately 15 million Americans whose credit reports contained medical debt entries. It characterized the rule as restoring "predictive accuracy" to credit reporting, on the basis that medical debt has limited predictive value for credit decisions.
The rule was vacated on July 11, 2025, by the U.S. District Court for the Eastern District of Texas in Cornerstone Credit Union League v. CFPB. The court agreed with the plaintiffs that the rule exceeded the Bureau's statutory authority and was contrary to the Fair Credit Reporting Act, on the basis that Congress specifically authorized creditors to consider coded medical debt information.
The vacatur was joint. The CFPB itself joined the plaintiffs in requesting it, an unusual posture for an agency whose rulemaking is being challenged. The Bureau's participation signaled a substantive shift in the agency's view of the rule under its current leadership.
The post-vacatur posture has been quiet. No replacement rulemaking is pending, and the Bureau has confirmed it will not reissue the related advisory opinion. For practical purposes, the federal regulatory effort to remove medical debt from credit reports is over, at least under the Bureau's current direction.
The federal rule failed in court. The voluntary practices that came before it never went anywhere. Equifax, Experian, and TransUnion announced changes to their medical debt reporting practices in March 2022, rolling out across 2022 and 2023, and those practices remain in effect.
Three changes did the bulk of the work:
The CFPB's own analysis estimated these voluntary practices removed roughly 70% of medical collection tradelines from consumer credit reports.
These practices were a market response to regulatory and public pressure, predating Regulation V's proposal and operating outside of it. The vacatur of the federal rule did not affect them. The bureaus could, in theory, reverse them, but no such reversal has been announced.
For collection agencies handling medical debt, the practical reality of reporting in 2026 is largely shaped by these voluntary practices. A medical collection account that does not meet the bureaus' reporting criteria will not appear on consumer reports, regardless of what state or federal law allows.
With the federal rule vacated, state law is the operative regulatory surface for medical debt reporting in the United States. More than fifteen states now have laws restricting or prohibiting medical debt from appearing on credit reports, and the count continues to grow.
The laws vary significantly in scope. They generally fall into three categories:
These laws apply broadly and bar inclusion of medical debt regardless of who furnishes the data.
These laws prohibit specific entities (hospitals, healthcare professionals, ambulances) from furnishing medical debt and prohibit credit reporting agencies from including such information on consumer reports.
These laws bundle credit reporting prohibitions with additional consumer protections such as interest rate caps, payment plan requirements, or restrictions on legal collection activity.
Several other states have enacted or are considering measures of varying scope. The list expands as new state legislation moves forward.
For multistate medical debt collection operations, the variation creates real operational complexity.
A consumer in Colorado, New York, California, and New Jersey may have medical debt of the same type and amount, but the rules governing whether, how, and by whom that debt can be reported differ across states.
Generic compliance practices that worked under uniform federal rules will not work here.
The federal vacatur, the voluntary credit reporting practices, and the state patchwork together produce a specific operational picture for agencies handling medical debt in 2026.
Three areas need active decisions.
The threshold question for any medical debt collection operation is whether to report medical debt to credit bureaus at all.
Most consumer-friendly cases are already off the table: The voluntary credit reporting practices have done much of the screening work. Three categories of medical debt no longer appear on consumer reports, regardless of agency action:
An agency that runs its current medical portfolio against these criteria will typically find a substantial share of accounts the bureaus would not include on consumer reports anyway.
For the remaining accounts, two factors drive the reporting decision.
1. State of residence: In states with comprehensive prohibitions (Colorado, California, Illinois), the question is settled by law, and the agency cannot report. In states without such prohibitions, reporting remains permitted but is still subject to the bureaus' own criteria.
2. Operational return on reporting effort: Reporting carries furnisher obligations under the FCRA: dispute investigation, accuracy maintenance, and Metro 2 reporting standards.
For an agency whose addressable reporting volume has shrunk substantially under the voluntary practices, the question becomes whether the remaining yield justifies the compliance overhead.
Some agencies have moved to internal credit reporting suspension on medical debt entirely, treating the channel as no longer worth maintaining for that asset class.
Medical debt collection at any meaningful scale now requires state-aware infrastructure.
The minimum operational requirements:
Manual handling of state variation works at a small scale. It does not work across multistate portfolios at meaningful volume. Agencies operating across more than a handful of states should expect to build a state-rule application into the platform configuration rather than agent training.
Several state medical debt laws layer additional consumer notice and validation requirements on top of the FDCPA and Regulation F baseline.
New York's Fair Medical Debt Reporting Act, for example, restricts when and how medical debt can be communicated about, and intersects with New York's existing debt collection rules under 23 NYCRR 1.
California's SB 1061 includes notice provisions tied to the prohibition on credit reporting. Several other state frameworks include enhanced validation language requirements specific to medical debt.
The operational implication is that agencies cannot rely on a single FDCPA-compliant validation template across all medical debt accounts. Validation language needs state-specific overlays, applied automatically based on the consumer's state of residence.
Standard validation templates that worked across general consumer debt portfolios may need separate medical debt variants in states with enhanced requirements.
For agencies running medical debt alongside other asset classes, this means treating medical debt as a separately configured account type within the platform, with its own validation, notice, and reporting rules layered on top of the base collection workflow.
Tratta's healthcare debt collection platform handles the operational requirements above as platform configuration rather than agent workflow.
State-of-residence triggers route accounts to the right reporting decision logic on intake. Validation overlays, notice requirements, and collection activity restrictions activate automatically based on the consumer's jurisdiction, with no manual flagging by collectors.
New state laws are onboarded by updating configuration rules, which match the operational reality of a state landscape that continues to expand. Request a demo to see how the configuration runs across a multistate medical debt portfolio.
The 2026 picture is settled enough to act on, but several factors could shift the landscape in the near term. Three are worth tracking.
1. The CFPB's posture could change under future administrations:
The Bureau's decision to join the plaintiffs in the vacatur reflected its current leadership's view of the rule. A future administration could reopen medical debt rulemaking, issue new advisory guidance, or take a different posture on credit reporting practices generally.
Agencies running long-horizon compliance programs should treat the federal silence as durable for now, but not permanent.
2. State legislation continues to expand:
More than fifteen states have active medical debt credit reporting laws, and several others have introduced or are debating similar measures. The pattern suggests continued state-level expansion regardless of federal direction.
Agencies should expect their addressable state list to grow each legislative session and configure compliance infrastructure to onboard new state rules without significant rework.
3. State laws may face FCRA preemption challenges:
The vacatur of the federal rule turned partly on a finding that Congress specifically authorized creditors to consider coded medical debt information under the FCRA.
The same statutory reasoning could support challenges to state laws that outright prohibit medical debt reporting, on the theory that they conflict with the federal scheme.
No major preemption challenge has succeeded against a state medical debt reporting law to date, but the legal terrain is unsettled enough that the question is open.
For agencies, the operational implication of all three is the same: build a compliance infrastructure that can absorb regulatory change quickly. The platform that handled medical debt collection well in early 2025 needed material reconfiguration by mid-2025 and again as state laws rolled out. The same is likely to hold across 2026 and 2027.
The CFPB medical debt rulemaking ran its full regulatory cycle within thirteen months. The proposal arrived in June 2024, the rule was finalized in January 2025, and a federal court vacated it the following July, with the Bureau itself joining the request.
What replaced it is not another federal rule but a layered operative regime: the voluntary credit reporting practices the major bureaus put in place during 2022 and 2023, and a state law landscape that has continued to expand independent of federal direction.
For agencies handling medical debt, the right operating posture is state-aware compliance, configured to absorb regulatory change quickly. The federal rule is not coming back in the near term, and the state landscape will continue to see new restrictions emerge.
Agencies that have built per-state reporting controls, validation overlays, and audit infrastructure are positioned for the regulatory environment as it actually exists. Agencies still waiting for federal clarity are positioned for one that did not survive court contact.
Tratta's healthcare debt collection platform is built for state-aware medical debt compliance, with per-jurisdiction validation language, reporting controls, and audit trails configured natively.
Request a demo to see how it works for the regulatory landscape as it stands today.
Most of it is not. The voluntary credit bureau practices remove paid medical collections, sub-$500 collections, and collections within their first year of unpaid status. State laws in more than fifteen states further restrict reporting. Whether a specific medical debt appears on a consumer's report depends on the debt amount, status, and the consumer's state of residence.
The rule, finalized in January 2025, prohibited consumer reporting agencies from including medical debt on credit reports and prohibited creditors from considering it in credit decisions. It removed the FCRA exception that had previously allowed creditors to use coded medical debt information. The rule was vacated before its March 17, 2025, effective date.
The U.S. District Court for the Eastern District of Texas vacated the rule on July 11, 2025, in Cornerstone Credit Union League v. CFPB. The court held that the rule exceeded the Bureau's statutory authority and contravened the FCRA. The CFPB itself joined the plaintiffs in requesting the vacatur and has confirmed it will not reissue the related advisory opinion.
More than fifteen states. Comprehensive prohibitions are in place in Colorado, California, and Illinois. New York's Fair Medical Debt Reporting Act takes a provider-targeted approach, imposing restrictions on credit reporting agencies. New Jersey and Connecticut have broader medical debt frameworks that include prohibitions on credit reporting. Scope varies across jurisdictions, so agencies should verify current requirements in each state where they operate.
Treat it as a state-by-state compliance exercise. Track the consumer's state of residence at the account level and apply the relevant reporting, validation, and notice rules per jurisdiction. Configure platform defaults to automatically apply state-specific overlays. Some agencies have moved to internal credit reporting suspension on medical debt across all states, treating the channel as no longer worth the FCRA furnisher overhead.
