Privacy Rights

To file a complaint with HHS, fill out a "Health Information Privacy Complaint" (PDF) form and file it within 180 days of the alleged act. Make sure you send your complaint to the appropriate regional office, via mail or fax.

Filing a ComplaintIf you believe that a HIPAA-covered entity or its business associate violated your (or someone else's) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification Rules, you may file a complaint with the Office for Civil Rights (OCR).

If you believe that a HIPAA-covered entity or its business associate violated your (or someone else's) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification Rules, you may file a complaint with the Office for Civil Rights (OCR).

A HIPAA violation is a failure to comply with any aspect of HIPAA standards and provisions detailed in detailed in 45 CFR Parts 160, 162, and 164.Failure to maintain and monitor PHI access logs. Failure to enter into a HIPAA-compliant business associate agreement with vendors prior to giving access to PHI.

If a patient or personal representative complains about a breach of confidentiality or a violation of a HIPAA rule, notify your supervisor and contact the representative listed on the Notice of Privacy Practices.

Start by correcting the breach if possiblestop any further disclosure or uses of unauthorized PHI. If the damage is already done, take measures to mitigate the breach. By completing an investigation, you should understand what caused the breach and determine ways of preventing similar breaches in the future.

You may file a complaint for yourself, your organization, or for someone else. If you need help filing a civil rights, conscience and religious freedom, or health information privacy complaint, please email OCR at OCRMail@hhs.gov or call 1-800-368-1019.

If you believe your privacy rights have been violated by us, you may file a complaint with us by notifying our Compliance Officer of your complaint. We will not retaliate against you for filing a complaint. You may also complain to us or to the Secretary of Health and Human Services.

The most common HIPAA violations that have resulted in financial penalties are the failure to perform an organization-wide risk analysis to identify risks to the confidentiality, integrity, and availability of protected health information (PHI); the failure to enter into a HIPAA-compliant business associate agreement;