What is the HHS Office for Civil Rights?

The HHS Office for Civil Rights (OCR) is the federal agency responsible for enforcing HIPAA privacy and security rules. They investigate complaints of HIPAA violations.

Can I file a complaint if my rights were violated?

Yes, you can file a complaint if you believe a healthcare provider or business associate violated your HIPAA rights. This is free and confidential.

How long do I have to file a complaint?

You have 180 days from when you discovered the violation to file a complaint with HHS OCR. This is called the statute of limitations.

What happens after I file a complaint?

HHS OCR will review your complaint and may investigate the healthcare provider. If they find a violation, they may require corrective action or impose penalties.

How to File a HIPAA Complaint with HHS/OCR

Quick Answer

If a healthcare provider violates your HIPAA rights, you can file a complaint with the HHS Office for Civil Rights (OCR). You have 180 days from the violation to file. Submit your complaint online at HHS OCR's website, by mail, phone, or fax. The process is free and confidential, and OCR will investigate the violation.

Understanding HIPAA Complaints

If you believe a healthcare provider or health plan has violated your HIPAA rights, you have the right to file a formal complaint with the federal government. The HHS Office for Civil Rights investigates these complaints and can impose penalties on violators.

What Constitutes a HIPAA Violation?

Refusing to give you access to your medical records
Denying your request to amend inaccurate information
Failing to provide an accounting of disclosures
Not honoring your request for confidential communications
Unauthorized disclosure of your health information
Not providing your Notice of Privacy Practices
Ignoring your request for restrictions on use/disclosure
Violating your privacy without proper authorization
Not maintaining security safeguards for your records

What's NOT a HIPAA Violation

Providers refusing treatment or billing issues (not privacy matters)
Poor quality of care (handled through other complaints)
Issues with a non-HIPAA covered entity (some healthcare providers)
Expired complaints (over 180 days old)

Important Deadlines and Timeframes

180-Day Statute of Limitations

You have 180 days from when you discovered the HIPAA violation to file a complaint. After 180 days, OCR cannot investigate. Mark your calendar if you believe a violation occurred.

Investigation Timeline

After you file, OCR typically takes several months to investigate. Don't expect an immediate response. OCR will contact you if they need additional information during the investigation.

Notice of Resolution

OCR will send you a letter explaining the outcome. This may take 6-12 months or longer depending on complexity. If they found a violation, they'll describe the corrective actions required.

How to File Your Complaint

Gather Your Documentation

Collect all evidence of the violation: copies of letters sent to the provider, their responses (or lack thereof), dates and times of incidents, names of people involved, and any supporting documentation. The more detailed, the better.

Try to Resolve with the Provider First (Optional)

Consider contacting the provider's privacy officer first to try resolving the issue directly. This sometimes resolves problems faster than a federal complaint. Document any communication attempts.

Complete the OCR Complaint Form

Use the official HHS OCR complaint form. You can find it at hhs.gov/ocr/privacy/hipaa/complaints. Include your name, contact information, the provider's name and address, a detailed description of the violation, when it occurred, and how it affected you.

Submit Your Complaint

Submit your complaint online through the OCR portal, by email to your regional OCR office, by mail, phone, or fax. The website provides contact information for regional offices based on your state.

Keep Records of Submission

Save confirmation emails or reference numbers from your submission. Keep copies of everything you send. OCR will likely contact you if they need more information.

Respond to OCR if They Contact You

If OCR needs clarification or additional information, respond promptly. Failure to respond may affect their investigation. They may also contact the provider for their response to your complaint.

Receive the Investigation Outcome

OCR will send you a letter with their findings. If they found a violation, the provider may be required to take corrective action or face penalties.

HHS OCR Contact Information

Online Complaint Portal

Visit www.hhs.gov/ocr/privacy/hipaa/complaints to file your complaint online. This is often the fastest method.

Regional OCR Offices

Each HHS region has an OCR office. Visit hhs.gov/ocr to find the office serving your state, or contact:

Phone: 1-866-627-4748 (toll-free)
TDD: 1-877-696-6775
Email: OCRComplaint@hhs.gov

Mailing Address (Varies by Region)

Contact the regional office serving your area for the specific mailing address.

Sample HIPAA Complaint Letter

[YOUR NAME] [YOUR ADDRESS] [YOUR PHONE NUMBER] [YOUR EMAIL] [DATE] HHS Office for Civil Rights [REGIONAL OFFICE ADDRESS] Re: HIPAA Privacy Complaint Against [PROVIDER NAME] Dear OCR Investigator, I am filing a formal complaint regarding a violation of my HIPAA privacy rights by [PROVIDER NAME AND ADDRESS]. COMPLAINT DETAILS: Provider Information: Name: [PROVIDER NAME] Address: [PROVIDER ADDRESS] Phone: [PROVIDER PHONE] Contact Person (if known): [NAME/TITLE] Nature of Violation: I believe the provider violated my HIPAA rights by [DESCRIBE THE VIOLATION - e.g., "refusing to provide access to my medical records" or "disclosing my health information without authorization"]. Timeline of Events: [DATE 1]: [What happened] [DATE 2]: [What happened] [DATE 3]: [What happened] Specific Actions Taken: - I submitted a written request for [WHAT YOU REQUESTED] on [DATE] - The provider [DID NOT RESPOND / REFUSED / INADEQUATELY RESPONDED] - [Any other relevant actions] Impact: This violation has affected me by [DESCRIBE HOW IT AFFECTED YOU - e.g., "preventing me from accessing my own medical records" or "compromising my privacy"]. Documentation Attached: - Copy of my request dated [DATE] - Copy of provider's response/denial dated [DATE] - [Any other relevant documentation] I have attempted to resolve this matter directly with the provider on [DATE(S)] without success. I request that HHS OCR investigate this violation and require the provider to come into compliance with HIPAA. Thank you for your attention to this matter. Sincerely, [YOUR SIGNATURE] [YOUR PRINTED NAME]