How an OCR HIPAA complaint works.
Anyone can file a HIPAA complaint with HHS Office for Civil Rights. Knowing the process helps a plan sponsor respond calmly and keep the right records.
How the process runs.
Filing Window
Complaints must be filed within 180 days of when the person knew of the act. OCR may extend that for good cause. Employers should treat any notice of a complaint as time sensitive and bring in counsel promptly. Staff should know that the deadline can sometimes be extended, but should not rely on it.
Who OCR Can Investigate
OCR can investigate covered entities and business associates, and certain substance use treatment programs. Employers with a group health plan should know whether the plan or its vendors fall in these categories. Counsel can help confirm how the rules apply to the plan and to each vendor.
Possible Outcomes
OCR may offer technical assistance, refer the matter, investigate or close it. An early response that is organized and respectful can help, though no outcome is guaranteed. Employers should work with counsel to prepare what to say and what documents to provide.
How a complaint is filed with the Secretary.
Who Can File
Any person who believes a covered entity or business associate is not complying can file a complaint with the Secretary. Complaints can come from employees, family members or others, so employers should treat privacy concerns seriously from the start. Make sure staff know how to route concerns internally.
In Writing
The complaint must be filed in writing, on paper or electronically. Employers should make sure staff know that a written concern may arrive in many forms, including email. Log every written complaint and send it to the privacy lead immediately.
What It Must Say
It must name the subject of the complaint and describe the acts or omissions that allegedly violate the rules. The complaint needs enough detail for OCR to understand the issue. Employers should expect to be asked about the specific events and should collect relevant records early.
The 180 Day Limit
A complaint must be filed within 180 days of when the person knew or should have known of the problem, though the Secretary can waive the limit for good cause. Employers should not assume an old issue is beyond review, since the limit can be waived. Keep records for the period the law requires and ask counsel how long to retain them.
When The Secretary Investigates
An investigation is required when a preliminary review points to willful neglect, and the Secretary may investigate any other complaint. Employers should expect that a complaint may lead to a request for records, and should prepare in advance. Counsel can advise on how to respond to an inquiry and on what to provide.
What An Investigation Covers
It can include reviewing the entity’s policies, procedures and practices, and the circumstances of the alleged violation. Investigators may ask for written policies, training records, risk assessments and vendor agreements. Keep these organized in one place so they can be produced quickly if requested.
Source: 45 CFR 160.306.
What plan sponsors can do.
Route It To The Right Person
Send any OCR letter to your privacy lead and counsel right away. Create a simple internal rule that any government letter about privacy goes to one named person the same day. That person should alert counsel and track every deadline in the letter.
Preserve Records
Keep policies, training logs and vendor agreements ready to show. Do not delete documents once a complaint is known, and ask counsel what to hold. Include emails, logs and meeting notes that relate to the issue, not only formal policies.
Do Not Retaliate
Retaliation against someone for filing a complaint is prohibited. Managers should know not to discipline or pressure anyone for raising a privacy concern. Include this reminder in training, and ask counsel to review any action involving a person who filed a complaint.
Three questions to settle.
Who Receives OCR Mail
Name the person who will open it and act on it. Use a role-based mailbox or a named alternate so letters are not missed during absences. Share the contact with reception, mailroom and IT so nothing sits unopened. Update the name whenever roles change.
Can We Show Our Documentation
Check that policies and training records are current. Review policies, risk analyses and training logs on a set schedule instead of waiting for a complaint. Fix gaps now, and note when each review was completed. Ask counsel what should be kept and for how long.
Do Vendors Know The Plan
Confirm business associates will cooperate quickly. Contracts should say who responds to requests and how quickly. Ask each vendor for a contact, and test the process by confirming who would pull records if OCR asked. Include this in vendor review meetings.
Common Questions About OCR Complaints
Who can file a complaint?
Any person who believes a covered entity or business associate violated HIPAA.
How long do they have?
180 days from when they knew of the act, with possible extension for good cause.
What can happen after an investigation?
The entity may be asked to comply voluntarily, take corrective action or settle. OCR may impose civil money penalties, and the entity can request a hearing.
Can we punish an employee who files?
No. Retaliation for filing is prohibited.
Does OCR investigate employers as employers?
OCR looks at covered entities and business associates, which can include the group health plan.
Is this legal advice?
No. For an actual complaint, involve your counsel. We can help you organize your documentation.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. § 160.306 — Filing a HIPAA complaint with the Office for Civil Rights.
42 U.S.C. § 1320d-5 — Civil penalties for HIPAA violations.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.