Report HIPAA Violations

Report HIPAA Violations and Complaints

HIPAA allows for two kinds of complaints about privacy violations:

1.) complaints directly to the entity where the violation occurred; and/or,

2.) complaints to the federal government, which are received by the Office for Civil Rights (OCR), a department of the U.S. Department of Health and Human Services (HHS).

To report an alleged violation directly to the entity where the violation occurred, ask for the entity's "Privacy Officer" or "HIPAA Officer." You will typically be asked to submit your complaint in writing, along with some basic facts about the circumstances.

Complaints to the federal government can now be submitted over the Internet. A special division of the US Department of Health and Human Services (HHS), called the Office for Civil Rights (OCR) is the right place to take your HIPAA complaint. Valid complaints will be investigated and acted upon by the OCR.

By law, anyone can file written complaints with OCR. However, HIPAA complaints must meet certain conditions before the OCR can take action:
 

Complaints must...

1.)  Be filed in writing, either on paper or electronically, by mail, fax, or email;

2.)  Name the covered entity involved and describe the acts or omissions you believe violated the requirements of the Privacy Rule; and

3.)  Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show "good cause."

File Your HIPAA Complaint Online...

In English

In Spanish

In Chinese

In Korean

In Vietnamese

In Polish

In Tagalog

In Russian

More great, free HIPAA information from HHS is HERE.