Filing a Health Information Privacy Complaint

You may file a complaint with the Office for Civil Rights (OCR) if you believe:

• A HIPAA covered entity or its business associate violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification Rules.
• A substance use disorder (SUD) treatment program violated your confidentiality rights under 42 CFR part 2 (called “Part 2”).

OCR can investigate health information privacy complaints against covered entities (health plans, health care clearinghouses, or health care providers that conduct certain transactions electronically) and their business associates. OCR can also investigate complaints of Part 2 violations against a Part 2 program or its qualified service organization; a lawful holder of Part 2 records, such as a HIPAA covered entity or its business associate; or another person holding Part 2 records.