How to Report a HIPAA Privacy Violation

The Health Insurance Portability and Accountability Act (HIPAA) provides federal protections for personal health information. If you believe your, or someone else's, privacy or security rights have been violated you have the right to file a complaint. You can file complaints with the Office for Civil Rights (OCR). You can file written complaints to OCR on paper or electronically. Individuals also have the right to file a complaint with the entity where the act occurred. Specific instructions for filing a complaint with an entity can be found on that entity's privacy notice.

Things You'll Need

• Adobe Reader
• Email, fax or stamp and envelope

Show More

Instructions

Filing a Complaint Using the Health Information Privacy Complaint Package

• 1

  Go to the Department of Health and Human Services: Office of Civil Rights website for access to the PDF file titled Health Information Privacy Complaint Package. Click on the link to open the package. The package is eight pages. The first two pages are the complaint form, pages 3 and 4 are a consent form and the remaining pages include additional information on privacy rights.

• 2

  Fill out the first page of the document.You cannot save the form. Required information includes your contact information and the name, full address and phone number of the person or organization you believe violated health information privacy rights. Briefly describe the incident, stating how, why and when it occurred. Sign and date at the bottom of the first page.

  The second page of the document is voluntary information. If you need special accommodations for communicating with you, select from the list of options (i.e. Braille, TDD, etc...). Page 2 has space for you to list an alternate contact. If you have filed before fill out where you filed, the date filed and the case number (if known).

  Read through the Complainant Consent Form on page 3 of the package. Check the appropriate consent box on page 4; sign and date and print your name, address, and phone number. The remaining pages provide additional information regarding your right to file a complaint.

• 3

  Print a copy of the completed form for mail or fax submissions. Remember the form cannot be saved. If you chose not to print it, you will lose all completed information.

• 4

  Mail or fax pages one through four of the package to the appropriate regional Office for Civil Rights. There are 10 regional offices. Select the office managing the state where the offense occurred. Contact information for each office is listed on page 2 of the package. Alternately, you can send the completed package electronically via e-mail to [email protected].

  Keep pages 5-8 for your own reference. If you have unanswered questions, contact your regional OCR office for assistance.

Filing a Complaint without the Complaint Package Forms

• 5

  Write or type a letter detailing the complaint. The letter must include your name, address, telephone numbers and an email address if you have one. Provide the name, full address and phone number of the person or organization you believe violated health information privacy rights. Briefly describe the incident, as well as, how, why and when it occurred. Add additional information as you see fit. Sign and date your complaint letter. If you are filing a complaint on someone's behalf, provide the name of the person on whose behalf you are filing.

• 6

  Add any special instructions for communicating with you and alternate contacts in case you cannot be reached. If you have filed somewhere else, include when and where you have filed.

• 7

  Mail or fax your letter to the appropriate regional Office for Civil Rights. There are 10 regional offices. Select the office managing the state where the offense occurred. Contact information for each office is listed on the OCR website. Alternately, you can send the letter electronically via email to [email protected].

  If you have unanswered questions, contact your regional OCR office for assistance.