You ignored the prominent question about your state. A lot of what you can or cannot do depends on your state laws. However, I'll give you some comments with the understanding that the answers may completely change when more details are known.

the JDB is now suing,
Does that mean you have been served a summons through a court accompanied by a complaint? Or are you just being threatened with a lawsuit?

If the former, how much money are you being sued for? What is the alleged date of default? What court? Small claims or regular? What does the summons instruct you to do? Appear? File a written answer? What was the date that the lawsuit was filed?

Can the JDB do this legally? If not, how can I prove in court that they're doing this?
You raise the defense that they don't own the debt and have no authority to sue. You seek documents during discovery.

Don't I still have rights to my own medical records, even if I think they're fraudulent? Why am I forced to go through a law firm?
Medical records are separate from financial records. The hospital still has them. Go to the hospital's records department. Fill out the appropriate forms and get copies of your records. It's likely that the hospital only gave the JDB the financial records.

Should I wait to report identity theft until I have more evidence,
Yes.

knowing the evidence might have been erased?
You don't know that. You're just assuming it.

Are there any resources you can point me to
No. Not until you answer all the questions so we have something to go on.