The Office for Civil Rights enforces the HIPAA Privacy Rule, which protects the privacy of individually identifiable health information; the HIPAA Security Rule, which sets national standards for the security of electronic protected health information; and the confidentiality provisions of the Patient Safety Rule, which protect identifiable information being used to analyze patient safety events and improve patient safety.
How To File a Complaint
If you believe that a covered entity violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy or Security Rule, you may file a complaint with OCR. OCR can investigate complaints against covered entities.
COMPLAINT REQUIREMENTS - Your complaint must:
Be filed in writing, either on paper or electronically, by mail, fax, or e-mail;
Name the covered entity involved and describe the acts or omissions you believe violated the requirements of the Privacy or Security Rule; and
Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show "good cause."
ANYONE CAN FILE! - Anyone can file a complaint alleging a violation of the Privacy or Security Rule. We recommend that you use the OCR Health Information Privacy Complaint Form Package. You can also request a copy of this form from an OCR regional office. If you need help filing a complaint or have a question about the complaint or consent forms, please e-mail OCR at
[email protected].
HIPAA PROHIBITS RETALIATION - Under HIPAA an entity cannot retaliate against you for filing a complaint. You should notify OCR immediately in the event of any retaliatory action.
For information and help on how to submit a complaint go to the HHS (Health and Human Services) site and all the information is there for you.
Here is the link:
How To File a Complaint (http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html)
Good luck!
Shirley