Patient’s Guide to HIPAA Part II: The Seven Basic Patient Rights
Roadmap: Patient’s Guide to HIPAA: Part 2: Basic Patient Rights: Right to Receive an Accounting of Disclosures (FAQ 45 of 65)
You only are entitled to one free request in any 12-month period. Think about the best timing to make that request. If you learn that you were a medical identity theft victim two years ago, you probably should make the request right now. However, if the reason you are asking relates to a current activity (perhaps a hospitalization that just ended), it can take time for your records to be updated. Actions that follow a hospitalization, such as submitting a bill to an insurer or to the government, may not occur immediately. You might want to wait a week or two before asking for the accounting. If the institution’s privacy officer is helpful, the officer may be able to offer useful advice about timing.
Roadmap: Patient’s Guide to HIPAA: Part 2: Basic Patient Rights: Right to Complain to the Secretary of HHS (FAQ 46 of 65)
Yes. Any person who believes that a covered entity is not complying with the HIPAA privacy rule may file a complaint with the Office of Civil Rights at the Department of Health and Human Services. You do not have to be a patient of a health care provider or a beneficiary of a health insurance plan to file a complaint. For example, if you visit a relative in the hospital and see a violation, you can file a complaint.
Roadmap: Patient’s Guide to HIPAA: Part 2: Basic Patient Rights: Right to Complain to the Secretary of HHS (FAQ 47 of 65)
The Office of Civil Rights at HHS wants a complaint to be signed and to include:
Optional information that OCR requests includes:
Roadmap: Patient’s Guide to HIPAA: Part 2: Basic Patient Rights: Right to Complain to the Secretary of HHS (FAQ 48 of 65)
There’s now a reasonable chance that filing a complaint will produce a response and may lead to action. For a long time, enforcement of the Rule by the Office of Civil Rights was rare. In the last few years, OCR has become much more aggressive in enforcing the HIPAA privacy and security rules. Some of the penalties imposed on covered entities run in to the millions of dollars. If you file a complaint, it should receive appropriate attention. Remember, however, that the Privacy Rule complaint process is for HIPAA complaints. OCR receives and rejects many complaints because they are not about HIPAA matters.
Roadmap: Patient’s Guide to HIPAA: Part 2: Basic Patient Rights: Right to Complain to the Secretary of HHS (FAQ 49 of 65)
Now that the complaint process is working, filing a complaint with OCR has real potential to help. There is a real reason for the public to show interest in privacy laws and to use the process to protect individual rights guaranteed by law.