Home
FAQ's
HIPAA links
Contact Us

Protecting the Privacy of Personal Health Information

 
 

Compliance & Enforcement

 

How to File a Health Information Privacy Complaint

Health Information Privacy Complaint Form [PDF]

Interim final rule: Civil Money Penalties: Procedures for Investigations, Imposition of Penalties, and Hearings [PDF]

 
 

GENERAL INFORMATION

 

The Privacy Rule

HIPAA Statute

The Security Rule

Identifier Standards

What is the Privacy Rule and why has HHS issued regulations?

Privacy Rule Summary [PDF]

HIPAA Glossary & Acronyms

 
 

SMALL PROVIDERS & BUSINESSES

 

HIPAA essentials outline

HIPAA Checklist

OCR Summary - HIPAA Privacy Rule

Frequently Asked Questions

Am I a covered entity?

Covered Entity Flowchart

 
 

HIPAA - Related Links

 

Centers for Medicare and Medicaid Services (CMS)

The Privacy Rule and Public Health (CDC)

The Privacy Rule and Research (NIH)

National Committee on Vital and Health Statistics (NCVHS)

Workgroup for Electronic Data Interchange

Portability of Health Coverage - Dept. of Labor

Full List of HIPAA-Related Links

 
 

For Consumers

 

Fact Sheet: Protecting the Privacy of Patients' Health Information

 

Security Standards for the Protection of Electronic Protected Health Information

 
  HOW TO FILE A HEALTH INFORMATION PRIVACY COMPLAINT WITH THE OFFICE FOR CIVIL RIGHTS  

If you believe that a person, agency or organization covered under the HIPAA Privacy Rule ("a covered entity") violated your (or someone else's ) health information privacy rights or committed another violation of the Privacy Rule, you may file a complaint with the Office for Civil Rights (OCR).   OCR has authority to receive and investigate complaints against covered entities related to the Privacy Rule.  A covered entity is a health plan, health care clearinghouse, and any health care provider who conducts certain health care transactions electronically.  For more information about the Privacy Rule, please look at our responses to Frequently Asked Questions (FAQs) and our Privacy Guidance. (See the web link near the bottom of this form.)

Complaints to the Office for Civil Rights must: (1) Be filed in writing, either on paper or electronically; (2) name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of the Privacy Rule; and (3) be filed within 180 days of when you knew that the act or omission complained of occurred.  OCR may extend the 180-day period if you can show "good cause."   Any alleged violation must have occurred on or after April 14, 2003 (on or after April 14, 2005 for small health plans), for OCR to have authority to investigate. 

Anyone can file written complaints with OCR by mail, fax, or email.  If you need help filing a complaint or have a question about the complaint form, please call this OCR toll free number: 1-800-368-1019.  OCR has ten regional offices, and each regional office covers certain states.  You should send your complaint to the appropriate OCR Regional Office, based on the region where the alleged violation took place.  Use the OCR Regions list at the end of this Fact Sheet, or you can look at the regional office map to help you determine where to send your complaint.   Complaints should be sent to the attention off the appropriate OCR Regional Manager.

You can submit your complaint in any written format.   We recommend that you use the OCR Health Information Privacy Complaint Form which can be found on our web site or at an OCR Regional office.  If you prefer, you may submit a written complaint in your own format.  Be sure to include the following information in your written complaint:

  • Your name, full address, home and work telephone numbers, email address.
  • If you are filing a complaint on someone's behalf, also provide the name of the person on whose behalf you are filing.
  • Name, full address and phone of the person, agency or organization you believe violated your (or someone else's) health information privacy rights or committed another violation of the Privacy Rule.
  • Briefly describe what happened.  How, why, and when do believe your (or someone else's) health information privacy rights were violated, or the Privacy Rule otherwise was violated?
  • Any other relevant information.
  • Please sign your name and date your letter.

The following information is optional:

  • Do you need special accommodations for us to communicate with you about this complaint?
  • If we cannot reach you directly, is there someone else we can contact to help us reach you?
  • Have you filed your complaint somewhere else?

The Privacy Rule, developed under authority of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), prohibits the alleged violating party from taking retaliatory action against anyone for filing a complaint with the Office for Civil Rights. You should notify OCR immediately in the event of any retaliatory action.

To submit a complaint with OCR, please use one of the following methods.  If you mail or fax the complaint, be sure to follow the instructions above for determining the correct regional office.
 
Option 1:  Open and print out the Health Information Privacy Complaint Form in PDF format  (you will need Adobe Reader software) and fill it out.  Return the completed complaint to the appropriate OCR Regional Office by mail or fax.

Option 2:  Download the Health Information Privacy Complaint Form in Microsoft Word format to your own computer, fill out and save the form using Microsoft Word.  Use the Tab and Shift/Tab on your keyboard to move from field to field in the form.  Then, you can either: (a) print the completed form and mail or fax it to the appropriate OCR Regional Office; or (b) email the form to OCR at OCRComplaint@hhs.gov

Option 3:  If you choose not to use the OCR-provided  Health Information Privacy Complaint Form (although we recommend that you do), please provide the information specified above and either: (a) send a letter or fax to the appropriate OCR Regional Office; or (b) send an email OCR at OCRComplaint@hhs.gov

If you require an answer regarding a general health information privacy question, please view our Frequently Asked Questions (FAQs).  If you still need assistance, you may call OCR (toll-free) at: 1-866-627-7748.  You may also send an email to OCRPrivacy@hhs.gov with suggestions regarding future FAQs.  Emails will not receive individual responses.

OCR Regional Addresses:

Region I - CT, ME, MA, NH, RI, VT
Office for Civil Rights
U.S. Department of Health & Human Services
JFK Federal Building - Room 1875
Boston, MA 02203
(617) 565-1340; (617) 565-1343 (TDD)
(617) 565-3809 FAX
Region VI - AR, LA, NM, OK, TX
Office for Civil Rights
U.S. Department of Health & Human Services
1301 Young Street - Suite 1169
Dallas, TX 75202
(214) 767-4056; (214) 767-8940 (TDD)
(214) 767-0432 FAX
Region II - NJ, NY, PR, VI
Office for Civil Rights
U.S. Department of Health & Human Services
26 Federal Plaza - Suite 3313
New York, NY 10278
(212) 264-3313; (212) 264-2355 (TDD)
(212) 264-3039 FAX
Region VII - IA, KS, MO, NE
Office for Civil Rights
U.S. Department of Health & Human Services
601 East 12th Street - Room 248
Kansas City, MO 64106
(816) 426-7278; (816) 426-7065 (TDD)
(816) 426-3686 FAX
Region III - DE, DC, MD, PA, VA, WV
Office for Civil Rights
U.S. Department of Health & Human Services
150 S. Independence Mall West - Suite 372
Philadelphia, PA 19106-3499
(215) 861-4441; (215) 861-4440 (TDD)
(215) 861-4431 FAX
Region VIII - CO, MT, ND, SD, UT, WY
Office for Civil Rights
U.S. Department of Health & Human Services
1961 Stout Street - Room 1426
Denver, CO 80294
(303) 844-2024; (303) 844-3439 (TDD)
(303) 844-2025 FAX
Region IV - AL, FL, GA, KY, MS, NC, SC, TN
Office for Civil Rights
U.S. Department of Health & Human Services
61 Forsyth Street, SW. - Suite 3B70
Atlanta, GA 30323
(404) 562-7886; (404) 331-2867 (TDD)
(404) 562-7881 FAX
Region IX - AZ, CA, HI, NV, AS, GU, The U.S. Affiliated Pacific Island Jurisdictions
Office for Civil Rights
U.S. Department of Health & Human Services
50 United Nations Plaza - Room 322
San Francisco, CA 94102
(415) 437-8310; (415) 437-8311 (TDD)
(415) 437-8329 FAX
Region V - IL, IN, MI, MN, OH, WI
Office for Civil Rights
U.S. Department of Health & Human Services
233 N. Michigan Ave. - Suite 240
Chicago, IL 60601
(312) 886-2359; (312) 353-5693 (TDD)
(312) 886-1807 FAX
Region IX - AZ, CA, HI, NV, AS, GU, The U.S. Affiliated Pacific Island Jurisdictions
Office for Civil Rights
U.S. Department of Health & Human Services
50 United Nations Plaza - Room 322
San Francisco, CA 94102
(415) 437-8310; (415) 437-8311 (TDD)
(415) 437-8329 FAX
 
 
 

Copyright 2003-2010 ©HIPAAnews.org All Rights Reserved.