Skip to main content
U.S. flag

An official website of the United States government

Here’s how you know

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

HTTPS

Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

  • About HHS
  • Programs & Services
  • Grants & Contracts
  • Laws & Regulations
  • Radical Transparency
  • Big Wins
  • HIPAA for Individuals
  • Filing a Complaint
  • HIPAA for Professionals
  • Newsroom
Breadcrumb
  1. HHS
  2. HIPAA Home
  3. HIPAA for Individuals
  4. HIPAA FAQs for Individuals
  5. 352-If I believe that my privacy rights have been violated, when can I submit a complaint
  • HIPAA for Individuals
    • HIPAA & Reproductive Health
    • Mental Health & Substance Use Disorders
    • Your Rights Under HIPAA
      • Your Medical Records
      • Employers and Health Information in the Workplace
      • Personal Representatives
      • Family Members and Friends
      • Court Orders and Subpoenas
      • Notice of Privacy Practices
      • Right to Access
      • HIV and HIPAA
    • FAQs

If I believe that my privacy rights have been violated, when can I submit a complaint?

Answer:

By law, health care providers (including doctors and hospitals) who engage in certain electronic transactions, health plans, and health care clearinghouses, (collectively, “covered entities”) had until April 14, 2003, to comply with the HIPAA Privacy Rule. (Small health plans had until April 14, 2004, to comply).  OCR provides further information on its web site about how to file a complaint.

  • Activities occurring before April 14, 2003, are not subject to the Office for Civil Rights (OCR) enforcement actions.
  • After that date, a person who believes a covered entity is not complying with a requirement of the Privacy Rule may file with OCR a written complaint, either on paper or electronically.
  • This complaint must be filed within 180 days of when the complainant knew or should have known that the act had occurred.
  • The Secretary may waive this 180-day time limit if good cause is shown. See 45 CFR 160.306 and 164.534.

In addition, after the compliance dates above, individuals have a right to file a complaint directly with the covered entity. Individuals should refer to the covered entity’s notice of privacy practices for more information about how to file a complaint with the covered entity.

Date Created: 12/20/2002

Content created by Office for Civil Rights (OCR)
Content last reviewed December 28, 2022
Back to top

Subscribe to Email Updates

Receive the latest updates from the Secretary and Press Releases.

Subscribe
  • Contact HHS
  • Careers
  • HHS FAQs
  • Nondiscrimination Notice
  • Press Room
  • HHS Archive
  • Accessibility Statement
  • Privacy Policy
  • Budget/Performance
  • Inspector General
  • Web Site Disclaimers
  • EEO/No Fear Act
  • FOIA
  • The White House
  • USA.gov
  • Vulnerability Disclosure Policy
HHS Logo

HHS Headquarters

200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll Free Call Center: 1-877-696-6775​

Follow HHS

Follow Secretary Kennedy