If you discover that your organization’s management or a co-employee has committed a HIPAA violation, you may wish to report it to the Department of Health and Human Services’ Office for Civil Rights (OCR).
You are permitted to report HIPAA violations, although you should bear in mind that OCR will only investigate HIPAA violation complaints that are submitted within 180 days from the date of discovering a suspected HIPAA violation. In a number of cases, OCR allows an extension for filing the complaint, but only if there is a ‘good cause.’ This extension rule is not applicable to alleged HIPAA Privacy Rule violation cases taking place before April 14, 2003 and Security Rule violation cases before April 20, 2005.
OCR assesses complaints and investigates possible HIPAA violations and those complaints may result in sanctions and financial penalties. Any individual who wants to report a possible HIPAA violation can do so via the OCR website. The website will guide the user through the complaint process. Another way to report a complaint is via a downloadable form, which can then be faxed, mailed, or emailed to OCR.
HIPAA violation complaints can be submitted anonymously as it is not mandatory to give a name and contact information. However, OCR will be unlikely to investigate anonymous complaints.
Certain complainants prefer to remain anonymous because they are afraid of repercussions from their employer. OCR points out that it is unlawful for HIPAA-covered entities to retaliate against any individual who submits a HIPAA violation complaint. If OCR discovers any retaliatory efforts, the employer can face sanctions.
There is an option for individuals to submit a complaint that isn’t anonymous, while protecting their privacy. When signing the complaint form provided by OCR, sign your name and contact information. Then, in the consent portion at the bottom of the complaint form, tick the option to deny OCR permission to disclose your identity or any information about you. In the course of the investigation, OCR will not disclose your personal details. Submitting a complaint in this manner is still considered anonymous so it may cause delays or result in the closure of the investigation without any action taken against the violator.