Compliance at Midwest Service Bureau
Compliance isn't just a requirement — it's the foundation of everything we do.
- No recovery, no fee
- Licensed where required
- HIPAA compliant
Our Commitment to Regulatory Compliance
Debt collection is one of the most heavily regulated industries in the United States, and for good reason. Consumers and businesses deserve protection from unfair, deceptive, or abusive collection practices. At Midwest Service Bureau, we don't just comply with regulations — we embrace them as the foundation of how we operate. Our compliance program builds those rules into the collection workflow: Regulation F contact limits, required disclosures, dispute handling and compliance-staff review of flagged calls.
MSB runs a compliance program that includes dedicated compliance staff, technology-enforced communication limits, and ongoing monitoring of regulatory changes at both the federal and state level.
When you partner with MSB, our compliance becomes your protection. Every communication we send on your behalf — every phone call, letter, email, and text message — is written to follow current regulatory requirements.
Below, you'll find detailed information about the major regulatory frameworks that govern our operations and how MSB maintains compliance with each.
HIPAA Compliance
The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for the protection of individually identifiable health information. As a business associate of healthcare providers, MSB is required to maintain comprehensive HIPAA compliance covering the Privacy Rule, Security Rule, and Breach Notification Rule.
MSB's HIPAA compliance program includes:
- Business Associate Agreements (BAAs): We execute BAAs with every healthcare client before receiving any protected health information (PHI). These agreements define our obligations regarding PHI use, disclosure, safeguarding, and breach notification.
- Administrative Safeguards: Designated privacy and security officers, workforce training, access controls based on job function, sanction policies for violations, and regular risk assessments.
- Physical Safeguards: Controlled facility access, workstation security policies, locked storage for physical records, device and media controls, and visitor logging.
- Technical Safeguards: MSB receives PHI by encrypted file transfer (SFTP) and handles it under its HIPAA compliance program.
- Breach Response: Documented incident response procedures, prompt investigation of potential breaches, notification to affected individuals and clients within required timeframes, and HHS reporting for qualifying breaches.
Our HIPAA compliance program is reviewed and updated annually by our privacy officer, and all staff members receive HIPAA training during onboarding. Our collectors who work on healthcare accounts receive additional specialized training on minimum necessary PHI use and patient communication requirements.
Fair Debt Collection Practices Act (FDCPA)
The FDCPA is the foundational federal law governing third-party debt collection practices. It prohibits harassment, false or misleading representations, and unfair practices in the collection of consumer debts. The FDCPA also establishes requirements for debt validation, cease-and-desist requests, and communication practices.
MSB's FDCPA compliance program includes:
- Initial Communications: Every initial contact with a consumer includes the required mini-Miranda disclosure identifying MSB as a debt collector and stating that any information obtained will be used for debt collection purposes.
- Validation Notices: Written validation notices are sent within five days of initial contact, containing the amount of the debt, the name of the creditor, and the consumer's rights to dispute the debt and request verification.
- Communication Restrictions: We do not contact consumers before 8:00 AM or after 9:00 PM in their local time zone, at their workplace if we know the employer prohibits such calls, or after receiving a written cease-and-desist request.
- Dispute Handling: When a consumer disputes a debt, all collection activity ceases until verification is obtained and provided. Our system tracks dispute deadlines automatically to ensure timely compliance.
- Prohibited Practices: Our training and quality assurance programs prohibit threats, harassment, profanity, misrepresentations about the debt amount or legal status, and every other practice the FDCPA prohibits.
CFPB Regulation F
The Consumer Financial Protection Bureau's Regulation F (effective November 30, 2021) modernized the FDCPA's implementing regulations for the first time in decades. Regulation F clarified rules around communication frequency, electronic communications, time-barred debt, and validation notice content.
Key Regulation F provisions and how MSB complies:
- Communication Frequency Limits: Regulation F establishes a presumption of compliance for telephone calls limited to 7 attempts per debt per 7-day period, with no calls within 7 days after a telephone conversation. MSB collectors work accounts within these Regulation F limits.
- Electronic Communications: Regulation F permits debt collectors to communicate with consumers via email and text message, subject to opt-out requirements and specific content rules. MSB's electronic communication templates include the Regulation F opt-out mechanism in every message.
- Time-Barred Debt: Regulation F bars debt collectors from suing or threatening to sue on a time-barred debt (12 CFR 1006.26(b)). Where state law requires a time-barred-debt disclosure, MSB provides it. In some states, making a payment can restart the limitations period.
- Enhanced Validation Notices: Our validation notices use the model format endorsed by the CFPB, including an itemization of the debt, the consumer's rights and response options, and clear identification of the creditor.
State Licensing & Bonding
In addition to federal regulations, debt collection is regulated at the state level by a patchwork of licensing requirements, consumer protection statutes, and industry-specific rules. MSB is licensed where required (NMLS 2671949), and our compliance team monitors regulatory changes across every state to keep current with licensing renewals, bond requirements, and new regulatory obligations.
Many states have enacted consumer protection laws that go beyond the federal FDCPA, imposing additional restrictions on collection communications, requiring specific disclosures, limiting fee structures, or providing enhanced remedies for consumers. MSB's compliance program accounts for these state-specific requirements.
The state licensing landscape is complex and constantly evolving. As of 2026, over 35 states require debt collection agencies to obtain a specific license or registration before conducting collection activity within their borders. Requirements vary significantly: some states require only a simple registration filing, while others mandate surety bonds ranging from $5,000 to $100,000, background checks on all officers and directors, annual financial audits, and ongoing reporting of complaint volumes and collection activity data. MSB's compliance team maintains a comprehensive licensing calendar that tracks renewal dates, filing deadlines, and regulatory changes across every jurisdiction where we operate.
Our state compliance infrastructure also addresses the growing trend of state-level mini-FDCPA statutes that provide consumers with additional protections beyond the federal baseline. For example, New York's debt collection regulations require specific disclosures about consumer rights and impose restrictions on how interest and fees may be communicated. California's Rosenthal Fair Debt Collection Practices Act extends FDCPA-like protections to original creditor communications, not just third-party collectors. Massachusetts prohibits certain types of communications to consumers' employers. MSB's system maintains a state-specific ruleset for each jurisdiction.
We maintain detailed state compliance guides for our team and our clients. Select a state below to learn about the specific debt collection regulations that apply in that jurisdiction:
No Surprises Act Compliance
The No Surprises Act (effective January 1, 2022) protects patients from unexpected medical bills for emergency services, air ambulance services from out-of-network providers, and non-emergency services from out-of-network providers at in-network facilities. The Act also requires providers to give uninsured or self-pay patients good faith estimates of expected charges before scheduled services.
MSB has integrated No Surprises Act requirements into our healthcare collection workflow:
- Account Screening: Before pursuing collection on any healthcare balance, we review the account against No Surprises Act criteria. Accounts that may involve emergency out-of-network care, surprise billing scenarios, or good faith estimate requirements are flagged for compliance review before any collection activity begins.
- Balance Verification: We verify with our healthcare clients that patient balances reflect proper application of No Surprises Act protections — including independent dispute resolution (IDR) determinations and appropriate cost-sharing calculations — before initiating collection.
- Good Faith Estimate Disputes: When patients dispute bills that exceed a good faith estimate by more than $400, we understand the patient-provider dispute resolution process and suspend collection activity while disputes are resolved through the established channels.
- Ongoing Monitoring: Our compliance team monitors CMS and HHS rulemaking related to the No Surprises Act to ensure our procedures reflect the latest guidance and enforcement priorities.
TCPA Compliance
The Telephone Consumer Protection Act (TCPA) regulates the use of automatic telephone dialing systems (ATDS), prerecorded or artificial voice messages, and text messages for debt collection and other commercial purposes. TCPA violations can result in statutory damages of $500-$1,500 per violation, making compliance essential.
MSB's TCPA compliance program includes:
- Consent Management: Our system tracks consumer consent for calls and text messages at the account level, recording the type of consent obtained (express, express written), the source and date of consent, and any revocations.
- Do Not Call Compliance: We maintain an internal do-not-call list and scrub against the National Do Not Call Registry. When a consumer requests that we stop calling, the request is processed immediately and applied across all accounts for that consumer.
- Dialer Compliance: Our compliance program covers the TCPA rules on abandoned call rates, ring time and caller ID display. We maintain dialer logs and recordings for compliance auditing purposes.
- Cell Phone Protections: We apply appropriate consent requirements when contacting consumers on cell phones, consistent with the most current FCC interpretations and court rulings regarding ATDS definitions and consent standards.
- Text Message Compliance: All SMS and text message communications include required opt-out instructions and identify MSB as the sender. We honor opt-out requests immediately and maintain records of consumer preferences across all communication channels.
- Reassigned Number Database: MSB checks the FCC's Reassigned Numbers Database before calling cell phone numbers to avoid contacting consumers who have not consented to calls. This proactive step significantly reduces the risk of TCPA violations resulting from calls to numbers that have been reassigned to new owners since the original consent was obtained.
TCPA litigation represents one of the most significant legal risks facing the debt collection industry, with plaintiffs' attorneys actively seeking violations that can result in class-action damages. MSB's compliance program covers TCPA consent and do-not-call requirements.
Building a Culture of Compliance
At MSB, compliance is not a department — it is a core organizational value that permeates every aspect of our operations.
Our compliance culture is reinforced through several key practices:
- Hiring Standards: We screen all candidates for integrity and judgment during the hiring process, and we require compliance-focused references from previous employers in the collection industry.
- Training Program: Every new hire completes a comprehensive compliance training program before they ever contact a consumer. This training covers FDCPA, Regulation F, HIPAA, TCPA, state-specific regulations, and MSB's internal policies.
- Quality Monitoring: Quality is checked through manager audits, written reviews and regular training, and flagged call recordings are transcribed with AI assistance and scored by compliance staff. Collectors receive regular feedback and coaching based on these reviews.
- Incident Response: We maintain documented procedures for investigating and responding to potential compliance incidents, including consumer complaints, regulatory inquiries, and internal reports of possible violations.
Our commitment to compliance is not just about avoiding penalties — it's about doing business the right way.
Reviewed by Omar Taha, CEO, October 2026. This page is general information, not legal advice. Statutes change; verify with counsel.
Partner with a Compliance-First Collection Agency
Contact MSB today to learn how our compliance framework works.
- No setup fees
- No monthly minimums
- Contingency placements: you pay only when we collect