You are providing some amount of consent when you ask them to go verify. You are telling them to minimally verify that the bill belongs to you, that's what asking them to validate the debt means and hospitals are explicitly allowed to share this information just like they do with your employer for workers comp issues, insurance agencies for payment, etc etc etc.

Health privacy is not some magic button that shuts everything off. The hospital isn't going to say they saw you for jock itch and nurse Esmeralda dingled your berries, but they absolutely can share that they saw you for a specialty exam, billing code 123, on date 12/12/12, they verified it was you, billed your insurance and that their records show you never paid the remaining balance. That's a verified debt for the purposes of proving that you owe money.