Skip Navigation

How to File a Patient Safety Confidentiality Complaint

OCR enforces the confidentiality provisions of the Patient Safety and Quality Improvement Act of 2005 (Patient Safety Act) and the Patient Safety and Quality Improvement Rule (Patient Safety Rule).  The Patient Safety Rule went into effect on January 19, 2009. The Patient Safety Act and Rule establish a voluntary system for Patient Safety Organizations (PSOs) to aggregate and analyze data they receive from health care providers regarding medical errors and other patient safety events so as to improve patient safety and the provision of quality health care. To encourage provider reporting, the Patient Safety Act and Rule include Federal privilege and confidentiality protections for patient safety work product (PSWP).  Information submitted to, and developed by, these PSOs is protected as PSWP. 
 
 

HIPAA Privacy Rule Complaint

If you believe that a covered entity violated your (or someone else’s) health information privacy rights or committed another violation of the HIPAA Privacy Rule, you may file a HIPAA Privacy Rule Complaint with OCR.

If you believe that a person or organization impermissibly disclosed PSWP, you may file a complaint with OCR.  OCR is responsible for the investigation and enforcement of the confidentiality provisions of the Patient Safety Rule.  OCR will investigate complaints that allege potential violations of the Rule. To the extent practicable, OCR will provide technical assistance and seek informal resolution of complaints involving the impermissible disclosure of PSWP through voluntary compliance from the responsible person, entity or organization. When OCR is unable to achieve an informal resolution of an indicated violation through such voluntary compliance, the Secretary may impose a CMP of up to $11,000 for each knowing and reckless disclosure of PSWP that is in violation of the confidentiality provisions.

PSWP IS PROTECTED - PSWP is any information which (1) is assembled or developed by a health care provider for reporting to a PSO that is listed by the HHS Agency for Healthcare Research and Quality (AHRQ) and is documented as being within the provider’s patient safety evaluation system for reporting to a PSO; (2) is developed by a PSO for the conduct of patient safety activities; or (3) identifies or constitutes the deliberations, or analysis of, or identifies the fact of reporting pursuant to a patient safety evaluation system.

PSWP may identify patients, health care providers and individuals that report medical errors or other patient safety events.  This PSWP is confidential and may only be disclosed in certain very limited situations.  See the Patient Safety Rule for a full description of the permissible disclosures.  PSWP remains protected regardless of who holds the information.  For more information about the Patient Safety Act and Patient Safety Rule, please review our Understanding Patient Safety Confidentiality section on our web site, or the visit the Agency for Healthcare Research and Quality's web site.

COMPLAINT REQUIREMENTS – Your complaint must:

  1. Be filed in writing: sent by mail, fax or e-mail; 
  2. Name the person that is the subject of the complaint and describe the act or acts believed to be in violation of the Patient Safety Act requirement to keep PSWP confidential; and,
  3. Be filed within 180 days of when you knew or should have known that the act complained of occurred. OCR may waive the 180-day time limit for “good cause" shown.

ANYONE CAN FILE! - Anyone can file a complaint with OCR. We recommend that you use the OCR Patient Safety Confidentiality Complaint Form and Consent Form Package.  You can request a copy of this form from OCR headquarters. If you need help filing a complaint or have a question about the complaint package, please e-mail OCR at OCRMail@hhs.gov.

HOW TO SUBMIT YOUR COMPLAINT TO OCR -to submit a complaint to OCR, please use one of the following methods.

File A Complaint Using the OCR Patient Safety Complaint Form

  • Open and fill out the OCR Patient Safety Confidentiality Complaint Form and Consent Form Package in PDF format. You will need Adobe Reader® software to fill out the complaint package.  You may print and mail or fax the completed complaint package to OCR headquarters; or e-mail the completed complaint package to OCRComplaint@hhs.gov. If you e-mail the complaint to OCR, you do not need to sign the completed complaint and consent forms because submission by e-mail represents your signature.  (Please note that communication by unencrypted e-mail presents a risk that personally identifiable information contained in such an e-mail may be intercepted by unauthorized third parties.)

Hide Details

File a Complaint Without Using the OCR Patient Safety Complaint Form

  • If you choose not to use the OCR provided OCR Patient Safety Confidentiality Complaint Form and Consent Form Package, please provide the information specified below by mail, fax, or e-mail to OCRComplaint@hhs.gov.

    Be sure to include the following information in your written complaint:

    1.  Your name

    2.  Full address

    3.  Telephone numbers

    4.  E-mail address (if available)

    5.  If known, the name of the patient, provider or reporter whose information was allegedly disclosed.

    6.  Name, full address and phone (if known) of the person, agency or organization you believe impermissibly disclosed patient safety work product.

    7.  Briefly describe what happened. How, why, and when you believe a person impermissibly disclosed patient safety work product.  

    8.  Any other relevant information.

    9.  Your signature and date of complaint

    The following information is optional:

    1.  Do you need special accommodations for us to communicate with you about this complaint?

    2.  Who else can we call if we cannot reach you?

    3.  Have you filed your complaint with any other agency, person or entity? If so, where?

Hide Details