Collection agencies have to sign a privacy agreement with healthcare providers to work with them. They have access to as much information as the provider chooses to let them have, and whatever information they do receive, they are bound to protect under HIPAA just as if they were the provider itself.