Medical Debt and Credit Reports in 2026: What the Rules Really Say Now
Questions about whether medical debt can still appear on a credit report have circulated widely this year, and for good reason. Within roughly six months, a federal rule banning it nationwide was finalized, challenged in court, and vacated entirely. Coverage of the topic has not always kept pace with which version of that timeline currently applies. This overview covers where things stand in 2026, what can and cannot be reported, and where legal uncertainty remains.
The CFPB Medical Debt Rule: What Happened and Why It Was Vacated
In January 2025, the CFPB finalized a rule that would have banned medical debt from consumer credit reports entirely, regardless of amount or payment status, and barred lenders from using medical-debt information in credit decisions. It was scheduled to take effect March 17, 2025.
The rule never took effect. The Consumer Data Industry Association and the Cornerstone Credit Union League sued in the U.S. District Court for the Eastern District of Texas, arguing the rule exceeded the CFPB's authority under the Fair Credit Reporting Act, which permits reporting of medical debt information when it is coded to protect the underlying health details. Under new leadership, the CFPB joined the plaintiffs in asking the court to vacate the rule. On July 11, 2025, the court agreed and vacated it in full.
Medical Debt Credit Reporting Rules Currently in Effect
With the federal rule gone, the protections currently in place trace back to 2023, when Equifax, Experian, and TransUnion voluntarily adopted three changes: paid medical debt is removed from credit reports regardless of amount or how long it took to pay; unpaid medical collections under $500 are not reported at all; and new medical debt is subject to a 365-day grace period before it can appear on a report. The CFPB has estimated these voluntary changes removed roughly 70% of medical-debt tradelines from credit files nationally.
These are bureau policy decisions rather than legal requirements, and the bureaus retain the ability to revise them. For now, they represent the practical floor of protection for consumers, and the baseline that furnishing and collections processes should assume.
State Medical Debt Laws and the FCRA Preemption Question
Fifteen states, including California, Colorado, Connecticut, Delaware, Illinois, Maine, Maryland, Minnesota, New Jersey, New York, Oregon, Rhode Island, Vermont, Virginia, and Washington, have gone further than the voluntary bureau policy, enacting laws that ban or significantly restrict medical debt reporting for their residents regardless of amount or payment status.
The same Texas court that vacated the federal rule also found that the FCRA expressly preempts state laws imposing similar restrictions, on the reasoning that a state cannot prohibit what federal law affirmatively permits. That finding was not the direct subject of the case, since no specific state law was before the court, so it functions as a legal signal rather than a binding ruling on any individual state statute. It is a signal the industry is taking seriously, and further litigation testing whether state medical-debt reporting bans survive an FCRA preemption challenge is likely.
How to Apply Medical Debt Reporting Rules to Real Accounts
For a collections or recovery team working an actual portfolio, a layered operating assumption is more defensible than a binary one:
Paid medical debt and unpaid medical debt under $500 should not be furnished, per the 2023 bureau policy, regardless of state.
Unpaid medical debt of $500 or more that is less than 365 days old should not yet be furnished; the grace period should run first.
Unpaid medical debt of $500 or more, past 365 days, for a consumer in one of the 15 protected states, should be treated as non-reportable under current state law, even though its long-term enforceability remains an open legal question.
Unpaid medical debt of $500 or more, past 365 days, outside a protected state, is reportable under current federal law, provided the debt is properly coded to conceal the underlying medical condition, procedure, or provider. That coding requirement is the basis on which the FCRA permits reporting at all.
The compliance risk here has less to do with whether a ban exists and more to do with consistency. Reporting decisions that depend on a consumer's state of residence and the precise age and size of an account are straightforward in isolation and difficult to apply correctly at scale, especially as more state legislation moves through statehouses and the preemption question above works its way through further litigation.
Without reliance on credit impacts, it’s more important that ever to effectively prioritize accounts and match borrowers with channels and offers. This requires a deep understanding of your portfolio and precise value estimation- delivered through EQ Engine Collection Scores for healthcare debt.
Additionally, EQ Engage's embedded compliance rules and controls are designed to be informed automatically by a consumer's location and circumstances, so outreach stays compliant without manual review of every account. Applying that same logic, rules that travel with the account rather than living in a policy binder, is the direction this kind of jurisdiction-dependent reporting decision is headed as well.