There is no private right of action For violating HIPAA. Persons aggrieved by a covered entity's unauthorized released of personally identifiable health information may file a complaint with the Office of Civil Rights of the United States Department of Health and Human Services. That federal agency has the power to impose fines on covered entities for violating HIPAA, but none of those fines go back to compensate the complainant whose health information was released.
I do not see a violation
Criminal Law (all misdemeanor & felonies in District and Superior Courts), Drunk Driving and Drug arrests, Sex Offenses, SORB, Crimes involving Violence or Theft, Domestic (Divorce, Child Custody, Alimony and Child Support) and Family Law (Modification, Contempts & Paternity), Juvenile Law, Domestic Violence and Restraining Orders, Business Law, Personal Injury claims, Probate Law (Guardianships, Conservatorships & Estate Administration) and Legal Malpractice. For these and other areas, contact me. NOTE: This preceding message DOES NOT create an attorney-client relationship. It is not a protected or confidential communication. The statements made herein are not to be interpreted as representations or warranties of any kind. No reliance should be placed on the statements made herein. It is recommended that the recipient(s) should undertake their own research to reach their own opinion. The writer does not accept professional responsibility on this matter. TO CREATE an attorney-client relationship REQUIRES a signed retainer/fee agreement along with a retainer fee that must be received by my office.
The federal HIPAA law allows the providers / hospitals that treat you to release information in order to get paid without getting any specific permission from you. That includes giving information to collection agencies. I've linked the website for the Office for Civil Rights, which enforces HIPAA, below if you want more information on this point.
You may have other rights under Massachusetts law or laws relating to debt collection. If you are interested in getting more input on your situation you can change the "practice area" above to "debt collection" and perhaps get answers from attorneys that focus on that area of the law.
This response is intended to provide general information, but not legal advice. The response may be different if there are other or different facts than those included in the original question. See MKnutsonLaw.com for more information on why this communication is not privileged or create an attorney-client relationship.