If you believe that a person, agency or organization covered under the HIPAA Privacy Rule violated your (or someone else’s ) health information privacy rights or committed another violation of the Privacy Rule, you may file a complaint with the Office for Civil Rights (OCR). Such violations are listed on the HIPPA Compliance poster. OCR has authority to receive and investigate complaints against covered entities related to the Privacy Rule. A covered entity is a health plan, health care clearinghouse, and any health care provider who conducts certain health care transactions electronically.
Complaints to the Office for Civil Rights must:
(1) Be filed in writing, either on paper or electronically;
(2) Name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of the Privacy Rule; and
(3) Be filed within 180 days of when you knew that the act or omission complained of occurred. According to the HIPPA Compliance poster, OCR may extend the 180-day period if you can show “good cause.”
Any alleged violation must have occurred on or after April 14, 2003 (on or after April 14, 2004 for small health plans), for OCR to have authority to investigate.
Anyone can file written complaints with OCR by mail, fax, or email. OCR has ten regional offices, and each regional office covers certain states. You should send your complaint to the appropriate OCR Regional Office, based on the region where the alleged violation took place. Complaints should be sent to the attention off the appropriate OCR Regional Manager.
Be sure to include the following information in your written complaint:
Your name, full address, home and work telephone numbers, email address.
If you are filing a complaint on someone’s behalf, also provide the name of the person on whose behalf you are filing.
Name, full address, and phone of the person, agency, or organization you believe violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy Rule.
Briefly describe what happened. How, why, and when do believe your (or someone else’s) health information privacy rights were violated, or the Privacy Rule otherwise was violated?
Any other relevant information.
Please sign your name and date your letter.
The following information is optional:
Do you need special accommodations for us to communicate with you about this complaint?
If we cannot reach you directly, is there someone else we can contact to help us reach you?
Have you filed your complaint somewhere else?
The Privacy Rule, developed under authority of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), prohibits the alleged violating party from taking retaliatory action against anyone for filing a complaint with the Office for Civil Rights. You should notify OCR immediately in the event of any retaliatory action.
