How Is a HIPAA Complaint Filed With OCR?

A HIPAA complaint can be filed with the HHS Office for Civil Rights in writing, on paper or electronically, including through the OCR Complaint Portal. It must name the entity involved, describe the alleged violation, and generally be filed within 180 days of when the complainant knew or should have known of the act. Good cause extensions are possible.

Who may file. Under 45 CFR 160.306(a), any person who believes a covered entity or business associate is not complying with the HIPAA rules may file a complaint with the Secretary of HHS. OCR administers HIPAA enforcement for HHS.

Requirements (160.306(b)). The complaint must be in writing, on paper or electronically; name the person that is the subject of the complaint; describe the acts or omissions believed to be violations; and be filed within 180 days of when the complainant knew or should have known of the act or omission, unless the time limit is waived for good cause.

How. HHS accepts complaints through the OCR Complaint Portal, by mail, email, or fax. HHS complaint forms are available, but a complaint may also be submitted in the complainant's own format. No particular outcome is guaranteed.

What happens next. OCR must investigate when preliminary facts indicate a possible violation due to willful neglect and may investigate other complaints (160.306(c)). If an investigation indicates noncompliance, HHS may resolve the matter by informal means, which "may include demonstrated compliance or a completed corrective action plan or other agreement"; otherwise a civil money penalty may follow. If no violation is found, HHS informs the parties (160.312). OCR may refer possible criminal violations to the Department of Justice.

No retaliation. Covered entities and business associates may not intimidate, threaten, coerce, discriminate against, or retaliate against anyone for filing a complaint (45 CFR 160.316, 164.530(g)).

Internal complaints. Covered entities generally must also have a process for individuals to complain to the entity itself (164.530(d)), subject to the group health plan exception in 164.530(k).

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."