Medical Debt on Credit Report 2026: What Still Applies

Look up 12 CFR 1022.38 today and you will find a rule that tells credit bureaus when they may put medical debt into a report sent to a creditor. It is printed in the Code of Federal Regulations. It has a source note under it — [90 FR 3373, Jan. 14, 2025] — the kind of citation you would normally treat as settled. Earlier in the same subpart, § 1022.30(d) reads simply [Reserved]: the empty slot where the financial information exception used to sit, the paragraph that let a creditor use medical information of the kind routinely weighed in credit decisions.

A federal court vacated all of that fourteen months ago.

I pulled part 1022 from the eCFR versioner API on 14 September 2026. What comes back is the title 12 text as issued 8 September 2026, current through 10 September 2026 — and both quirks are still in it. That is where this page has to start, because the most common way to get 2026 wrong is to look the regulation up, find it, and believe it.

Everything below was read on 14 September 2026 and is quoted with the document it came from. I am not a lawyer and this is not a reading of your file — it is a map of where these particular rules live, so you can open them yourself and see whether they have moved since.

What the court did on 11 July 2025, and what it left alone

The rule was real, briefly. The CFPB published Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V) at 90 FR 3276 on 14 January 2025, with an effective date of 17 March 2025. It would have barred credit bureaus from putting medical debt into reports furnished to creditors, and barred creditors from considering it.

It never took effect. Trade groups sued in the Eastern District of Texas; the Bureau, under new leadership, asked the court to hold the effective date while it reconsidered, then joined the plaintiffs in asking for judgment against its own rule. On 11 July 2025 Judge Sean D. Jordan granted the joint motion and vacated the rule in full — Cornerstone Credit Union League v. CFPB, No. 4:25-cv-00016 (E.D. Tex.). His memorandum opinion is docket entry 52; final judgment is entry 53, signed the same day.

Did anyone appeal? Entry 53 is the last thing on the docket, and checking the Fifth Circuit's records on 14 September 2026 turned up nothing either. Nothing found is not the same as nothing filed, so treat that as a check worth repeating rather than a fact to lean on. It is worth knowing who would have had to do the appealing, though: not the plaintiffs and not the Bureau, who had jointly asked for this judgment, but the consumer groups the court let intervene against it.

The CFPB has not been coy about it. Its page for the rule, last modified 24 February 2026, opens with the vacatur and closes the description with one sentence worth copying down: "The materials relating to the FCRA Medical Debt Rule on the Bureau's website are for reference only."

What the court did not disturb is the statute the rule was built on top of. The FCRA still says a bureau may report medical debt to a creditor only in coded form — account status and amounts can travel, but not information sufficient to infer the provider or the nature of the services (15 U.S.C. § 1681b(g)(1)(C), working with § 1681c(a)(6)).

That coding requirement was the court's reason for striking the rule down, and the opinion opens on it: the FCRA "permits consumer reporting agencies … to report information about consumers' medical debt that has been coded to protect their medical privacy" and "authorizes creditors to consider such information when making credit decisions." Congress having permitted coded medical reporting, the Bureau could not forbid it. So the protection you actually have is narrow, and it is about identification rather than about the debt disappearing.

Three layers sit between a medical bill and your credit, and only one is law

The bureaus' own policy does most of the work. On 18 March 2022 Equifax, Experian and TransUnion announced jointly that they were cutting roughly 70% of medical collection tradelines out of credit reports. Their own summary of what that came to, published when the last piece landed on 11 April 2023: paid medical collections came off entirely from 1 July 2022, the wait before an unpaid one could appear went from six months to a year, and medical collections with an initial reported balance under $500 came off and stay off. Experian's current consumer page still states all three: a 365-day grace period after the delinquency date, nothing under $500, and removal once you pay.

None of that is enforceable against them by you. It is three companies' policy, adopted under pressure, and it survived the collapse of the federal rule because it never depended on it. It is also why a $310 lab bill in collections is invisible while a $520 one is not — a $210 difference that has nothing to do with either bill's merits.

Scoring models are a separate layer again. Experian's page notes that newer FICO models weight unpaid medical collections less heavily than other collections, and that newer VantageScore models do not count them at all. Which model a given lender pulls is not something you can find out in advance, so treat this as a reason not to panic over one tradeline, not a reason to ignore it.

One protection is actual statute, and it is for veterans. Under § 1681c(a)(7) and (a)(8), a nationwide bureau may not report a veteran's medical debt if the care was rendered less than a year before the report, and may not report a fully paid or settled veteran's medical debt at all — in each case where the bureau has actual knowledge that the debt is a veteran's medical debt. That last clause is doing real work. The bureau has to know. If you are a veteran with a VA-related bill in collections, saying so in writing is not a courtesy, it is what triggers the section.

The seven-year clock starts before the collection agency hears your name

This is the number people get wrong most reliably, and the reason is right there on the tradeline: the date printed most prominently is the date the collection agency opened the account, so that is the date the seven years look like they should run from.

It does not. § 1681c(a)(4) sets seven years for accounts placed for collection. Subsection (c)(1) then says when the clock starts: at the end of the 180-day period beginning on the date of the commencement of the delinquency which immediately preceded the collection activity. Not the date of service. Not the date of the collection agency's first letter. The date you first went delinquent with the original provider, plus 180 days.

And the furnisher has to report that date. Under § 1681s-2(a)(5)(A), whoever furnishes information about a delinquent account placed for collection must notify the bureau of the date of delinquency — the month and year the delinquency commenced — within 90 days of furnishing.

Two consequences follow. A re-aged account — one showing a delinquency date later than the truth, which happens most often after a debt is sold — buys the furnisher extra years on your report, and that date is checkable against your own bank records. And paying restarts nothing: under the FCRA the clock runs from delinquency regardless, while under the bureaus' policy payment is supposed to remove the line altogether. Those two facts sit oddly together, which is exactly why you verify with all three reports after paying instead of assuming.

A collection line should not exist before somebody contacted you

There is a rule most people have never heard of, and it is the cleanest thing on this page. 12 CFR 1006.30(a) says a debt collector must not furnish information about a debt to a credit bureau before it has either spoken to you about the debt in person or by telephone, or placed a letter in the mail or sent an electronic message and waited a reasonable period to see whether it bounces. If an undeliverable notice comes back during that period, it must not furnish until it has tried again.

So if a medical collection appears on your report and nothing ever reached you — no call, no letter — that is not merely unfair. It is the exact sequence § 1006.30(a) tells collectors not to follow. Whether a particular account breached it is for the bureau, the collector, or eventually a court to sort out, but the citation is short enough to put in the first sentence of your dispute rather than three paragraphs down, after the part about how the insurance was supposed to pay.

The related clocks come from the same part. The validation period runs for 30 days after you receive the validation notice, and the collector may assume you received it five business days after sending it (12 CFR 1006.34(b)(5)). Dispute in writing inside that window and § 1006.38(d)(2) requires the collector to cease collection of the disputed portion until it sends you verification of the debt. Ask in writing for the original creditor's name and address inside that window and § 1006.38(c) requires the same pause. Separately, with no deadline attached at all, 15 U.S.C. § 1692e(8) makes it a violation to communicate credit information known to be false, including the failure to communicate that a disputed debt is disputed.

Disputing while the claim is still under appeal

An open insurance appeal does not freeze credit reporting. Nothing connects the two systems — the plan is talking to you, the collector is talking to the bureaus, and neither has to wait for the other. What you can do is make the dispute exist on the credit side too, in parallel.

Dispute with the bureau and § 1681i(a)(1)(A) gives it 30 days to reinvestigate free of charge — extendable to 45 only if you supply additional information during the original 30 days, and not extendable at all if the item is found inaccurate or cannot be verified. Dispute directly with the furnisher and § 1681s-2(a)(3) bars it from continuing to furnish that information without notice that you dispute it. Direct disputes run through 12 CFR 1022.43, which is why your letter should identify the specific item, explain the basis, and enclose the documents rather than referring to them.

Two attachments carry more weight than anything you write. The EOB showing the plan's determination, and the itemized bill showing what the amount is actually made of — if you do not have the second one, the exact wording that gets it is a short job. And if you are still inside the plan's process, knowing which appeal track you are on determines what you can honestly say about the amount being wrong.

One overlap does exist and it is worth knowing precisely. If your bill is in the patient-provider dispute resolution process because it exceeded a good faith estimate, 45 CFR 149.620(c)(5) says that while the process is pending the provider or facility must not move the bill into collection or threaten to, should cease collection efforts if it has already moved, and must suspend late fees. The validation-period pauses above stop a collector already holding the account; this is the one provision that keeps the bill from being handed over in the first place. The $400 threshold that gets you in is narrower than most people assume, so check before relying on it.

Your state may still protect you, and that is being litigated right now

Fifteen states had laws restricting medical debt credit reporting as of the National Consumer Law Center's 3 September 2025 tally, which matches the Consumer Federation of America's state map. I have not recounted either list state by state for 2026, and the tally is dated on its face: it already flags Oregon's SB 605 as taking effect 1 January 2026, after the count was written. Treat both as a starting point rather than a census. They are also not interchangeable: some bar the bureaus from reporting, some bar providers and collectors from furnishing, some bar creditors from using what is reported. Three different targets — and which one your state picked decides who you complain to.

Then the ground moved. On 28 October 2025 the CFPB issued an interpretive rule, Fair Credit Reporting Act; Preemption of State Laws, 90 FR 48710, taking the position that the FCRA broadly preempts state credit reporting laws — and naming medical debt specifically as an area where the Bureau's own 2022 interpretation, withdrawn in May 2025, had been wrong. A week later, on 5 November 2025, ACA International sued Colorado over HB 23-1126: ACA International v. Fulford, No. 1:25-cv-03530 (D. Colo.), before Judge R. Brooke Jackson. I checked that docket on 14 September 2026 and it is alive and undecided — a scheduling order entered 12 June 2026, dismissal briefing moving in July 2026, no ruling on the merits.

The Cornerstone opinion does contain a sentence saying that any state law barring a bureau from furnishing a report with coded medical information would be preempted. NCLC's position is that the sentence is dicta: no state statute was before the court, none was briefed, and the judgment struck the CFPB rule without touching any state law. NCLC also notes that the court cited no preemption case law at all, including Consumer Data Industry Association v. Frey, 26 F.4th 1 (1st Cir. 2022), which had held a state medical debt reporting restriction not preempted. Whether the sentence carries any weight is one of the questions the Colorado case puts in front of a judge — though a single district court will not settle it for the other fourteen states, and the case could still end on procedural grounds without reaching it.

None of which tells you what a court will say about your state's statute. What it does tell you is where the complaint goes if a tradeline looks like it breaks that statute: your state attorney general or banking regulator, not the CFPB, which no longer has a medical debt rule to enforce.

Pull three reports, then write two dates beside every medical tradeline

The nationwide bureaus have been offering free reports weekly rather than the annual one the FCRA requires, and NCLC's advice is to order through the central source at annualcreditreport.com rather than by opening an account directly with a bureau, which may come with an arbitration clause attached.

Pull all three. Medical collections appear inconsistently across them, and one clean report tells you nothing at all about the other two. Then, beside each medical tradeline, write down two things:

1. The date of delinquency the furnisher reported, and what your own records say the first missed payment actually was. A gap between those two is the most checkable error on the page.
2. The date you first heard from the collector — a call, a letter, anything, with proof if you have it. If that date falls after the tradeline was opened, § 1006.30(a) is your opening line.

If the initial reported balance was under $500, or you have paid it, or the delinquency began less than a year ago, the tradeline should not be there at all under the bureaus' own policy. Say so, name the April 2023 release where they set out all three changes, and send it certified.

Then give it 30 days. That is what § 1681i(a)(1)(A) allows them, and it is the only clock on this page that runs in your favour.