The CFPB noted the primary federal laws governing debt collection and credit reporting of medical debt provide only “narrow” preemption, allowing states to go beyond federal protections.