Patient’s Guide to HIPAA – Basic Rights: Can I File a Federal Complaint about a HIPAA Problem?
You are reading the Patient’s Guide to HIPAA, FAQ 46 .
HIPAA Guide Quick Links:
FAQ 46: Can I File a Federal Complaint about a HIPAA Problem?
Yes. Any person who believes that a covered entity is not complying with the HIPAA privacy rule may file a complaint with the Office of Civil Rights at the Department of Health and Human Services. You do not have to be a patient of a health care provider or a beneficiary of a health insurance plan to file a complaint. For example, if you visit a relative in the hospital and see a violation, you can file a complaint.
You can find information about the complaint process at http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html. There is a list of regional offices at http://www.hhs.gov/ocr/office/about/rgn-hqaddresses.html including phone numbers. OCR wants you to file a complaint at the regional office for your state, and the website provides addresses and fax numbers. However, OCR doesn’t necessarily make it easy. There is no email address for each regional office. If you look hard enough through the OCR website, you will find that you can submit a complaint by email to OCRComplaint@hhs.gov. An emailed complaint does not require a signature.
OCR has a complaint form that you can fill out at http://www.hhs.gov/ocr/privacy/hipaa/complaints/hipcomplaintform.pdf. The complaint website has information in other language about how to file a complaint. You can use email to ask questions or need help. You can e-mail OCR at OCRMail@hhs.gov, but there’s no guarantee that you will get a response.
In recent years, OCR opened a large number of investigations in response to complaints from individuals and otherwise. The total number of investigations that found a violation of HIPAA privacy and security rules averaged 2000 a year for the last ten years. That is a lot of violations and a lot of activity by OCR. There’s a reasonable chance that a well-founded complaint will result in a review and change. Filing a complaint with OCR should be worthwhile.