Question: Does the HIPAA Privacy Rule prohibit health care providers or insurance plans from calling in a debt collection agency to deal with delinquent payments? Answer: No. Debt collection falls under the auspices of what the Privacy Rule defines as "payment." Thus, a covered entity may enter into a business associate agreement with a debt collection agency in order to obtain payment. Remember, though, that disclosures to collection agencies must adhere to the provisions of the Privacy Rule.