How to File a HIPAA Violation

The U.S. Department of Health and Human Services Office for Civil Rights is charged with enforcing the rights and protections afforded consumers by the Health Insurance Portability and Accountability Act of 1996, also known as HIPAA. Violations as they pertain to the release and disclosure of your medical records or denial of access to them can be reported. Making a complaint is a simple process.

Instructions

• 1

  Download the Health Information Privacy Complaint Package and complete it fully. This will help to outline the details of the complaint and provide the Office for Civil Rights, OCR, with information to investigate the violation.

• 2

  File the completed complaint within 180 days of the date of the violation. After this time frame the decision to review your complaint is in the hands of the Secretary of the OCR. The Secretary will decide if there was good cause for the delay in the reporting, such as injury or personal matters, and if the complaint will be reviewed.

• 3

  Email the completed package directly to OCR. The email address is [email protected]. You can also use this email for general questions or concerns about the complaint process.

• 4

  Fax or mail the completed package, if email isn't available, to the appropriate OCR office. Offices are based throughout the United States and service ten different regions. Office locations can be located online at the U.S. Department of Health and Human Services website.

• 5

  Contact the entity itself that you believe violated your rights if the time frame to file with the OCR has passed. Ask them for a copy of their privacy policies and how to lodge a complaint. Read over the privacy policies to understand your rights as a patient and consumer and how violations are handled.