Lawsuit: Debt collector broke patient privacy laws