When the management or employees in your organization violate the HIPAA rules and you happen to know about, would you report it to the Department of Health and Human Services’ Office for Civil Rights (OCR)? Only HIPAA violation complaints that have been submitted within 180 days of date of discovery of the incident will result in investigative action. In some cases when there is ‘good cause,’ an extension may be granted for filing the complaint. (This rule wasn’t applied to alleged HIPAA Privacy Rule violations that happened prior to April 14, 2003 and Security Rule Violations that happened prior to April 20, 2005.)
OCR takes action when individuals submit complaints of HIPAA Rules violation by a healthcare organization. Any person who wishes to submit a complaint can use the online complaint portal developed by OCR. The portal has all the information that a person may want to know before submitting a complaint. A complaint portal assistant is also available to help complainants assess if OCR will investigate a case. Another way to submit a complaint is by using a form that can be downloaded from OCR. Fill up the form and email, fax or send your complaint by local mail.
If an individual wishes to submit a complaint anonymously, he may do so since it’s not compulsory to give a name and contact details when submitting a complaint. But, complaints that are anonymous will not get immediate response. No investigation against the covered entity will proceed.
Some complainants choose to be anonymous because of fear of getting terminated from work or facing backlash from colleagues. But OCR pointed out that it is illegal for HIPAA-covered entities to retaliate on complainants in any way. If they do, they will be penalized when OCR learns of their retaliatory actions. Knowing that, it is best for individuals to provide their name, signature and contact details when submitting a complaint of alleged HIPAA violations.
There’s a way to submit a complaint that is not anonymous but OCR will not reveal the complainant’s identity. When filling up the complaint form from OCR, put your name and contact details. Then at the bottom of the complaint form is the consent form. Signify to deny OCR consent to reveal your identity or any identifying information about you. During the investigation, OCR will not give your personal information to the covered entity or business associate. Submitting a complaint this way is still in a way anonymous and could result to investigation delays or closure without any action taken against the covered entity.