If you are willing to pay and have some time, I say go the HIPAA route.
Read through it some more and if you have questions, feel free to ask and I will do my best to help you.
It took me reading it a few times for it to make sense..
Oh and definitely stay off of the phone with those jerks....with the HIPAA method you have no communication AT ALL with the CAs...
NCO is constantly violating laws and they are just rude......so you are honestly better off just not talking to them.