How to File a HIPAA Complaint - Step-by-Step Guide?
Learn how to file a HIPAA complaint with the Office for Civil Rights (OCR). Step-by-step guidance for reporting privacy violations, timelines, and what to expect.
Loading...
Loading...
Continue your research
Related medical records and patient rights resources.
Learn how to file a HIPAA complaint with the Office for Civil Rights (OCR). Step-by-step guidance for reporting privacy violations, timelines, and what to expect.
Your provider violated your privacy rights. Here is how to report it to the Office for Civil Rights — and what happens next.
File a HIPAA complaint if a healthcare provider, health plan, or healthcare clearinghouse:
Collect details about the violation:
You can file a complaint:
Complete the OCR Health Information Privacy Complaint Form with:
OCR will review your complaint and notify you of the outcome. The process typically takes several months. They may resolve it through voluntary compliance, corrective action, or civil penalties.
If a provider is blocking your access to records, we can help you request them properly.
Get Your Medical RecordsFile a HIPAA complaint with the HHS Office for Civil Rights (OCR) at hhs.gov/ocr/complaints. You can submit online, by mail, or by fax. The complaint must be filed within 180 days of when you knew or should have known about the violation, though OCR may waive this deadline for good cause.
OCR will review your complaint, and if it falls within their jurisdiction, they will investigate. OCR may attempt informal resolution, issue technical assistance, or pursue a formal investigation. OCR can impose civil monetary penalties on covered entities found to have violated HIPAA. Not all complaints result in penalties.
HIPAA does not provide a private right of action, meaning individuals cannot directly sue covered entities for HIPAA violations. However, you may have state law remedies available such as breach of confidentiality or negligence claims. Contact an attorney specializing in healthcare law to explore your options.
HIPAA complaints must generally be filed within 180 days of when you knew or should have known about the violation. OCR may grant an extension if you can show good cause. Waiting too long may result in OCR declining to investigate your complaint.