Hi Greg. Welcome
True, you cannot use HIPAA laws now... a 1 2 punch.....maybe..
I am assuming you didn't get the PFD agreement in writing? Do you remember who you spoke with?
On a paid collection, when you have nothing to lose (since you've paid them off and they can't sue or harass you) I prefer to give them a taste of their own medicine by being a total pain in the ass and calling them as often as I can (hopefully speaking to the same person)......I will stay very polite.....and waste their time....because their time is money. If you can annoy them enough, they will probably cave in and just delete it. But that's just me. :p
You can also just try disputing it with the CRAs first.