My employer needed confirmation of my dortors appointment to get paided for the holiday,so I call my doctor to fax the confimation to my supervisor,the voicemail pickup at the dortors office so I left the message on there,upon returning from a meeting with my unit my boss came to me with a fax from the dortor with my full medical report.I was in shock and so was she I then call the dortors office and spoke with the nurse and this is what she had to said in her defense(you said you want proof of your visit fax to your supervisor)i told her that exacly right why did you not just send a letterhead and state that I had an appointment on Friday,my medical history was not needed.I then stated isn't there some type of private law that you just broke,she didn't say anything.my problem is I work in a large office and I have no ideal who saw my medical history report and now I just feel violated and angry,is there something that I can do so that this will not happen again.

Q. How do I report HIPAA Privacy violation.

A. If you believe that a person, agency or organization covered under the HIPAA Privacy Rule ("a covered entity") violated your (or someone else's ) health information privacy rights or committed another violation of the Privacy Rule, you may file a complaint with the Office for Civil Rights (OCR). OCR has authority to receive and investigate complaints against covered entities related to the Privacy Rule. A covered entity is a health plan, health care clearinghouse, and any health care provider who conducts certain health care transactions electronically. For more information about the Privacy Rule, please look at our responses to Frequently Asked Questions (FAQs) and our Privacy Guidance. (See the web link near the bottom of this form.)

Complaints to the Office for Civil Rights must: (1) Be filed in writing, either on paper or electronically; (2) name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of the Privacy Rule; and (3) be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show "good cause." Any alleged violation must have occurred on or after April 14, 2003 (on or after April 14, 2004 for small health plans), for OCR to have authority to investigate.

Anyone can file written complaints with OCR by mail, fax, or email. If you need help filing a complaint or have a question about the complaint form, please call this OCR toll free number: 1-800-368-1019. OCR has ten regional offices, and each regional office covers certain states. You should send your complaint to the appropriate OCR Regional Office, based on the region where the alleged violation took place. Use the OCR Regions list at the end of this Fact Sheet, or you can look at the regional office map to help you determine where to send your complaint. Complaints should be sent to the attention off the appropriate OCR Regional Manager.

You can submit your complaint in any written format. We recommend that you use the OCR Health Information Privacy Complaint Form which can be found on our web site or at an OCR Regional office. If you prefer, you may submit a written complaint in your own format. Be sure to include the following information in your written complaint:


Your name, full address, home and work telephone numbers, email address.

If you are filing a complaint on someone's behalf, also provide the name of the person on whose behalf you are filing.

Name, full address and phone of the person, agency or organization you believe violated your (or someone else's) health information privacy rights or committed another violation of the Privacy Rule.

Briefly describe what happened. How, why, and when do believe your (or someone else's) health information privacy rights were violated, or the Privacy Rule otherwise was violated?

Any other relevant information.

Please sign your name and date your letter.
The following information is optional:


Do you need special accommodations for us to communicate with you about this complaint?
If we cannot reach you directly, is there someone else we can contact to help us reach you?
Have you filed your complaint somewhere else?

my employer needed confirmation of my dortors appointment to get paided for the holiday,so i call my doctor to fax the confimation to my supervisor,the voicemail pickup at the dortors office so i left the message on there,upon returning from a meeting with my unit my boss came to me with a fax from the dortor with my full medical report.i was in shock and so was she i then call the dortors office and spoke with the nurse and this is what she had to said in her defense(you said you want proof of your visit fax to your supervisor)i told her that exacly right why did you not just send a letterhead and state that i had an appointment on friday,my medical history was not needed.i then stated isn't there some type of private law that you just broke,she didn't say anything.my problem is i work in a large office and i have no ideal who saw my medical history report and now i just feel violated and angry,is there something that i can do so that this will not happen again.


Yes, you would report the violation.

This is clearly a violation of the HIPPA law. I work in a doctors office, and if information is ever requested, we have to have written consent to release absolutely any medical notes, signed by the patient (called a release of information). You are absolutely right to be upset, and you should report it, if not through the above procedures, at least to the office manager at the doctors office. This could very well result in the termination of that nurse's employment. Per HIPPA, we cannot even discuss information on the phone with anyone who is not the patient or the patients guarantor (guardian or power of attorney usually) and even some information cannot be released to the patient themselves. HIPPA stands for Health Information Privacy Protection Act. There are major fines and/or jail time involved when this is violated. Please do not let this go without contacting the appropriate people to get this resolved. I would also mention it directly to the doctor the next time I saw him/her, so that they are aware of what is going on in their own office.

This is clearly a violation of the HIPPA law. I work in a doctors office, and if information is ever requested, we have to have written consent to release absolutely any medical notes, signed by the patient (called a release of information). You are absolutely right to be upset, and you should report it, if not through the above procedures, at least to the office manager at the doctors office. This could very well result in the termination of that nurse's employment. Per HIPPA, we cannot even discuss information on the phone with anyone who is not the patient or the patients guarantor (guardian or power of attorney usually) and even some information cannot be released to the patient themselves. HIPPA stands for Health Information Privacy Protection Act. There are major fines and/or jail time involved when this is violated. Please do not let this go without contacting the appropriate people to get this resolved. I would also mention it directly to the doctor the next time I saw him/her, so that they are aware of what is going on in their own office.


HIPAA - not HIPPA - stands for Health Insurance Portability and Accountability Act of 1996 (HIPAA).

PHIPA stands for Personal Health Information Protection Act.

You are confusing two different Acts/Laws here.

HIPAA - not HIPPA - stands for Health Insurance Portability and Accountability Act of 1996 (HIPAA).

PHIPA stands for Personal Health Information Protection Act.

You are confusing two different Acts/Laws here.


Sorry that is right... :p

Probably should not try to answer too many of these with acronyms when I am on pain medication... However, these laws are in place for good reason and I, for one (and sometimes I feel like I am the only one that takes them seriously in my office), am all for protecting the patient's information and feel that any violation, or even perceived violations, need to be brought to someone's attention so that people can be properly educated and know their rights!

Thanks JudyKayTee for the clarification!

Sorry that is right... :p

Probably should not try to answer too many of these with acronyms when I am on pain medication... However, these laws are in place for good reason and I, for one (and sometimes I feel like I am the only one that takes them seriously in my office), am all for protecting the patient's information and feel that any violation, or even perceived violations, need to be brought to someone's attention so that people can be properly educated and know their rights!!

Thanks JudyKayTee for the clarification!!


No problem - I do the same thing with too little coffee in my system!:D