Filing a Complaint With a HIPAA-Covered Entity

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Under the HIPAA Privacy Rule, individuals have the right to make complaints concerning a covered entity's compliance with the HIPAA Privacy Rule, its Notice of Privacy Practices, and its HIPAA privacy policies and procedures. Individuals also have the right to make complaints concerning the covered entity's breach notification process, and compliance with the Breach Notification Rule.

The Privacy Rule also requires a covered entity to refrain from intimidating, threatening, coercing, discriminating against, or retaliating against any individual who has exercised one of the above rights.

Individuals have the right to make complaints concerning a business associate's compliance with the HIPAA Security Rule and its Security Rule policies and procedures.The Security Rule requires a business associate to refrain from intimidating, threatening, coercing, discriminating against, or retaliating against any individual who has exercised.

Covered entities and business associates should develop a HIPAA complaint process that allows for complaints to be reported and investigated.

The HIPAA Privacy Rule requires covered entities to maintain documentation of all complaints, and the disposition of each, for a period of at least six years. The HIPAA Security Rule must maintain documentation of all complaints received, and the disposition of each, for a period of at least six years.