If you believe that a covered entity or business associate violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security or Breach Notification Rules, you may file a complaint with OCR. OCR can investigate complaints against covered entities and their business associates.
COVERED ENTITIES and BUSINESS ASSOCIATES - A covered entity is a health plan, health care clearinghouse, and any health care provider that conducts certain health care transactions electronically. A business associate is a person or entity that performs functions on behalf of, or provides services to, a covered entity that involve access to protected health information. For more information, please review our Understanding Health Information Privacy section or look at our responses to Frequently Asked Questions (FAQs) on our web site.
COMPLAINT REQUIREMENTS - Your complaint must:
- Be filed in writing, either electronically via the OCR Complaint Portal. or on paper by mail, fax, or e-mail ;
- Name the covered entity or business associate involved and describe the acts
or omissions you believe violated the requirements of the Privacy, Security, or Breach Notification Rules; and
- Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180-day period if you can show "good cause."
ANYONE CAN FILE! - Anyone can file a complaint alleging a violation of the Privacy, Security or Breach Notification Rules. We recommend that you use the OCR Complaint Portal or the OCR Health Information Privacy Complaint Form Package. You can also request a copy of this form from an OCR regional office . If you need help filing a complaint or have a question about the complaint or consent forms, please e-mail OCR at OCRComplaint@hhs.gov .
HIPAA PROHIBITS RETALIATION - Under HIPAA an entity cannot retaliate against you for filing a complaint. You should notify OCR immediately in the event of any retaliatory action.
HOW TO SUBMIT YOUR COMPLAINT - To submit a complaint, please use one of the following methods.