How to Report a HIPAA Violation: Complete Step-by-Step Guide
Published on
December 3, 2025
/
updated on
October 21, 2026
Where to report a HIPAA violation, how to file an OCR complaint within 180 days, anonymity, what OCR does next, and 60-day breach deadlines.
You have two routes when you decide how to report a HIPAA violation, and you can use both. One is the privacy official or complaint contact of the clinic, hospital, health plan, or vendor involved; the other is a written complaint to the HHS Office for Civil Rights (OCR), filed within 180 days (1, 2).
A billing coordinator sees a colleague open a neighbor's chart, or a patient asks a clinic for her records and hears nothing back. Each has to pick a channel, and the two run on different rules for names and deadlines. A complaint to OCR must carry your name to be investigated (3). This guide is for patients and families, for staff at clinics, hospitals, and health plans, and for the privacy officers and vendors who receive these complaints.
Work through these five steps in order:
- Write down what happened: dates, people, and records. Keep the notes yourself.
- Check that HIPAA covers it: the organization must be a covered entity or a business associate, and the act must break a HIPAA rule (4).
- Choose where to report: the privacy official, OCR, or both.
- File in writing within 180 days, and put your name and contact information on the complaint.
- Keep a copy and watch for retaliation: tell OCR at once if anyone retaliates (3).
What Counts as a HIPAA Violation You Can Report
You can report a covered entity or its business associate that fails to follow the HIPAA Privacy, Security, or Breach Notification Rules (5). Health plans, health care clearinghouses, and most health care providers are covered entities (3, 4). A business associate creates, receives, maintains, or transmits protected health information (PHI) on a covered entity's behalf (4).
Employers, life insurers, and workers' compensation carriers are generally not covered entities, and neither are many schools (4). A disclosure the HIPAA Privacy Rule permits is not a violation of HIPAA either, such as a doctor sending your test results to a second doctor who needs them to treat you (3).
OCR lists the five issues people have alleged most often since 2003, in this order (6):
- Impermissible uses and disclosures of PHI: unauthorized access, such as a staff member reading a neighbor's chart, or a disclosure of PHI to a third party with no right to it.
- Lack of safeguards for PHI: improper disposal of paper files, an unlocked file room, or another gap that exposes patient records.
- Denied access to your own PHI: a provider will not let you see or get a copy of your own medical records.
- Missing administrative safeguards for electronic PHI: HIPAA Security Rule measures such as a risk analysis, access rules, or workforce security training are absent (7).
- More than the minimum necessary: a whole record goes out when one test result would have answered the question.
Who Do You Report a HIPAA Violation To?
Your report goes to the organization's privacy official or complaint contact, to OCR, or to both. The notice of privacy practices must tell you that you may complain to the organization and to HHS (1).
Where to Report a HIPAA Violation
The first two routes in Table 1 are the general ones. A covered entity must offer a complaint process for individuals (8), and anyone can file a complaint with OCR (5). The other four depend on who broke the rule and how. When the organization is outside HIPAA, OCR cannot take a HIPAA complaint against it (4), and a personal health record vendor may fall to the FTC instead.
Table 1. Where to report a HIPAA violation
| Route | Use it when | What it can do | Deadline |
|---|---|---|---|
| The organization's privacy official or complaint contact | You want the organization to fix the problem | Receive and document your complaint; mitigate known harm (8) | The 180 days for OCR keep running (2) |
| HHS Office for Civil Rights (OCR) | An organization the HIPAA Rules cover broke them | Investigate; require corrective action, settle, or impose civil money penalties (9) | 180 days; waivable for good cause (2) |
| OCR, for substance use disorder records (42 CFR Part 2) | A treatment program or holder of Part 2 records breached your confidentiality | Investigate through the same portal (5) | Generally 180 days (9) |
| State Attorney General | The violation harmed residents of your state | Sue to stop violations or to obtain damages for residents (10) | Not stated by HHS |
| Department of Justice (on OCR's referral) | Someone knowingly obtained or disclosed a covered entity's health information without authorization | Investigate the criminal cases OCR refers (11) | Not stated by HHS; an OCR complaint has 180 days (2) |
| Federal Trade Commission | A personal health record vendor outside HIPAA had a breach | Enforce its own breach rules for those vendors (12) | Not stated by HHS |
Sources: as numbered in each row; read October 2026.
Figure 1 shows whether to report inside the organization, to OCR, or both. Answer three questions in order: whether the organization is a covered entity or business associate, whether you are within 180 days of when you knew or should have known, and whether you can raise the problem safely inside.
Reporting to the Organization's Privacy Officer
Start inside when you work there or when a quick fix would end the harm, such as a misdirected record that can still be retrieved.
The covered entity must document your HIPAA violation report and its outcome, whether it reached the HIPAA privacy officer or the complaint contact, and keep the record for 6 years (8). Its other duties are listed under The Internal Complaint Process below.
Reporting to the HHS Office for Civil Rights
Go to OCR directly when the internal reporting channel has not answered, when you fear retaliation, or when you are a patient with no contact inside the organization. Denied access to your own medical records also fits here.
OCR acts on a written complaint against a covered entity or business associate (2). Filing with OCR does not stop you from telling the organization as well.
How to File a HIPAA Complaint
You file a HIPAA complaint with OCR in writing, online through the OCR Complaint Portal, or by mail or email (3).
The OCR Complaint Portal
The portal sits at ocrportal.hhs.gov. Open it and choose the type of complaint. Give as much detail as you can about yourself and what happened, plus anything else that may help OCR review it. Then sign the complaint electronically and complete the consent form, where you can also ask for confidentiality. Once the consent form is done, you can print a copy of your complaint, and you should keep it (3).
OCR lists a toll-free number, 800-368-1019, and a TDD line, 800-537-7697, on its contact page (13). The complaint itself still goes in writing (2).
Written Complaints by Mail or Email
HHS's complaint process page explains how to make a HIPAA complaint in writing without the portal, either with its HIPAA Privacy and Security Complaint Form Package or in your own format (3). Mail it to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201, or email it to OCRComplaint@hhs.gov.
HHS warns that "communication by unencrypted email presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties" (3).
Required Complaint Details
The regulation's minimum for a HIPAA violation complaint is a written complaint that names the person or organization it is about and describes the acts or omissions you believe broke the rules (2). For a complaint in your own format, HHS asks you to include these details (3):
- Name and full address.
- Telephone numbers, with the area code.
- An email address, if you have one.
- The name, full address, and telephone number of the person, agency, or organization you believe violated your privacy rights.
- A brief description of how, why, and when the violation happened.
- Any other relevant information.
- A signature and the date of the complaint.
If you cannot tell whether the facts show a potential violation, HHS's advice is "If you are not sure, go ahead and file your complaint" (3).
The 180-Day Filing Deadline
You have 180 days for filing a HIPAA complaint, counted from when you knew or should have known that the act or omission occurred, and HHS can waive the limit for good cause (2). OCR's own example of good cause is a circumstance in which filing within 180 days was impossible (4).
The conduct itself must also have happened within the past 6 years (4). A violation from 3 years ago that you could not have known about until last month still qualifies; one from 7 years ago does not, however recently you found out.
Write down the date the violation occurred and the date you learned of it. Keep anything that shows when you found out, such as the message that told you.
How to Report a HIPAA Violation Anonymously
To limit who learns your identity, file with OCR under your own name and ask on the consent form that OCR keep your name and contact information confidential during the investigation (3). Inside an organization, anonymous reporting depends on the channel it offers, because the regulation requires a process for complaints and leaves its form to the organization (8).
Anonymous and Confidential Complaints
OCR does not investigate complaints filed without a name and contact information (3). A confidential complaint carries both. The consent form explains that OCR may need to share your name with the organization to investigate. You ask for confidentiality by checking "CONSENT DENIED" on the form. HHS says consent is not always needed to investigate a complaint, and that this denial is likely to impede the investigation and may result in its closure (14).
Confidentiality has a practical limit. When OCR first writes to the organization about a complaint, it describes the acts or omissions the complaint is about (2). A suspected violation that only one person could have seen, such as a refused copy of your own records, may point to you even if OCR withholds your name. The retaliation rules below apply in that case.
Protection Against Retaliation
A covered entity or business associate may not threaten, intimidate, coerce, harass, discriminate against, or retaliate against anyone for these three acts (15):
- Filing a complaint with HHS.
- Testifying, assisting, or participating in an investigation, compliance review, proceeding, or hearing.
- Opposing a practice the HIPAA Rules make unlawful, with a good-faith belief that it is unlawful, in a reasonable manner that does not involve an impermissible disclosure of PHI.
A covered entity also may not make you waive your right to complain to HHS as a condition of treatment or payment. The same ban covers enrollment in a health plan and eligibility for benefits (8). If retaliation happens, HHS says to notify OCR immediately (3).
If you are on a covered entity's workforce or are one of its business associates, 45 CFR 164.502(j)(1) adds one more protection. It applies when you believe in good faith that the entity broke the law or professional or clinical standards. It also applies when you believe its care or conditions potentially endanger patients, workers, or the public. You may then disclose PHI to one of these without putting the entity in violation (16):
- A health oversight agency or public health authority authorized by law to investigate or oversee the conduct.
- An appropriate health care accreditation organization.
- An attorney retained to advise you on your legal options.
If you are on the covered entity's own workforce, its sanctions duty does not apply to that disclosure (8).
Who Investigates HIPAA Violations?
The HHS Office for Civil Rights investigates HIPAA complaints and decides what happens after one is filed. It also runs compliance reviews and refers possible criminal violations to the Department of Justice (11).
What Happens After You File
Most complaints close after the first step, before any investigation (see Table 2). One that goes the full way moves through these steps:
- Preliminary review: OCR must investigate when a preliminary review points to possible willful neglect and may investigate any other complaint (2).
- Investigation: the organization must cooperate and give OCR access to its records, PHI included (17).
- Informal resolution: where OCR finds noncompliance, it can resolve the matter through demonstrated compliance or a completed corrective action plan, and it tells you in writing (18).
- Proposed penalty: if informal means fail, the organization gets 30 days to submit evidence of mitigating factors or affirmative defenses before OCR proposes a civil money penalty (18).
- Closing letter: OCR issues a letter describing the resolution, and an organization that receives a penalty can request a hearing before an HHS administrative law judge (9).
How OCR Closed Complaints in 2024
OCR resolved 28,228 complaints in calendar year 2024, and 62% of them closed before an investigation began. Of the 1,370 investigations, 9 ended in a resolution agreement and corrective action plan with a monetary settlement, or in a civil money penalty, for $1,180,781 in all (19). Figure 2 shows where complaints leave the process, and Table 2 counts each exit.
From April 2003 to October 31, 2024, OCR received over 374,321 HIPAA complaints. It found 255,953 of them not eligible for enforcement and settled or imposed a civil money penalty in 152 cases (6). OCR does not generally release information to the public on current or potential investigations (20). The four civil penalty tiers OCR applies are explained in the HIPAA fines and penalties guide.
Table 2. How OCR closed HIPAA complaints in 2024
| How the complaint closed | Complaints | Share OCR reports |
|---|---|---|
| After intake and review, before any investigation | 17,466 | 62% of resolutions |
| Technical assistance in place of an investigation | 9,392 | 33% of resolutions |
| Investigated: corrective action obtained | 663 | 48% of investigations |
| Investigated: no violation found | 704 | 51% of investigations |
| Investigated: technical assistance after it began | 3 | under 1% of investigations |
Source: HHS OCR, Annual Report to Congress for Calendar Year 2024 (19); read October 2026.
Who Else Enforces HIPAA
Two other enforcers work beside OCR:
- State Attorneys General can sue for state residents to stop violations or to obtain damages (10). Damages run up to $100 per violation, at most $25,000 a year for identical violations (21).
- The Department of Justice handles the criminal cases OCR refers. Under 42 U.S.C. 1320d-6, anyone who knowingly obtains or discloses a covered entity's health information without authorization can be prosecuted, employees included. The penalty is up to $50,000 and 1 year in prison, or up to $100,000 and 5 years under false pretenses. The maximum rises to $250,000 and 10 years if the aim is commercial advantage, personal gain, or malicious harm (22).
HIPAA Violation Reporting Requirements
Two of a covered entity's HIPAA reporting duties bear directly on violations. It sends breach notices on fixed deadlines, and it keeps a process for receiving and recording complaints. A business associate reports breaches to the covered entity it serves. Covered entities must have written breach notification policies, train workforce members on them, and sanction those who do not comply (12). A staff member follows those policies.
Breach Notification Deadlines
Each affected individual gets notice without unreasonable delay and no later than 60 calendar days after a breach of unsecured PHI is discovered, whatever its size. A breach counts as discovered on the first day any workforce member or agent, other than the person who committed it, knows of it or would have known with reasonable diligence, so the count can start before anyone tells the privacy officer (23).
The organization carries the burden of showing that every required notice went out, or that the incident was not a breach (29). Table 3 sets out the other deadlines. Because the HHS line is 500 or more and the media line is more than 500 residents of a State, a breach of exactly 500 people means an HHS notice alongside the individual notices, and no media notice.
Table 3. HIPAA breach notification deadlines
| Who notifies | Whom | When it applies | Deadline |
|---|---|---|---|
| Covered entity | Each affected individual | Any breach of unsecured PHI | Without unreasonable delay, no later than 60 calendar days after discovery (23) |
| Covered entity | Prominent media outlets | More than 500 residents of a State or jurisdiction | The same 60 calendar days (24) |
| Covered entity | HHS, through its online portal | 500 or more individuals | At the same time as the individual notices (25, 26) |
| Covered entity | HHS | Fewer than 500 individuals | Within 60 days after the end of the calendar year, from a log (25) |
| Business associate | The covered entity | Any breach of unsecured PHI | Without unreasonable delay, no later than 60 calendar days after discovery (27) |
| Covered entity or business associate | Any of the above | A law enforcement official says notice would impede a criminal investigation or damage national security | For the time a written statement specifies; an oral statement delays it by 30 days at most unless a written one follows (28) |
Sources: as numbered in each row; read October 2026.
The Internal Complaint Process
The HIPAA regulations put the rules for complaints about a covered entity's own privacy practices mostly in 45 CFR 164.530 (8). A covered entity's policies and procedures need to cover these duties:
- A privacy official and a complaint contact, both designated, with the designations documented.
- A process for complaints about the entity's policies and procedures or its compliance with them.
- A record of each complaint received, with its disposition, if any.
- 6-year retention of that record, from its creation or the date it was last in effect, whichever is later.
- HIPAA training for every workforce member on the entity's policies, as each person's job requires.
- Sanctions for staff who fail to comply, and mitigation of known harm where practicable.
- A notice of privacy practices that tells individuals they may complain to the entity and to HHS, describes how to complain to the entity, and states that no one is retaliated against for complaining (1).
Check Your HIPAA Complaint and Breach Process Before OCR Does
A complaint process and a breach notification policy are easier to fix before anyone files. Our HIPAA compliance services start with a readiness or gap assessment. We assess your complaint process, breach notification policy, and risk analysis against the HIPAA Rules and name the gaps. After that, we support your remediation and review the result, and your team keeps its risk management plan current.
Our risk assessments also cover the risks to patient data and the access controls around it. Talk to an expert before the first complaint arrives.
Sources
- eCFR, 45 CFR 164.520(b)(1)(vi), Notice of privacy practices: complaints. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.520
- eCFR, 45 CFR 160.306, Complaints to the Secretary. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-C/section-160.306
- HHS, How to File a Health Information Privacy or Security Complaint. https://www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html
- HHS, What OCR Considers During Intake & Review. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/what-ocr-considers-during-intake-and-review/index.html
- HHS, Filing a Health Information Privacy Complaint. https://www.hhs.gov/hipaa/filing-a-complaint/index.html
- HHS, HIPAA Enforcement Highlights, October 2024. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html
- eCFR, 45 CFR 164.308, Administrative safeguards. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- eCFR, 45 CFR 164.530, Administrative requirements. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530
- HHS, What to Expect. https://www.hhs.gov/hipaa/filing-a-complaint/what-to-expect/index.html
- HHS, State Attorneys General. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/state-attorneys-general/index.html
- HHS, Enforcement Process. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html
- HHS, Breach Notification Rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- HHS Office for Civil Rights, Contact the Office for Civil Rights (OCR). https://www.hhs.gov/ocr/about-ocr/contact-ocr/index.html
- HHS Office for Civil Rights, HIPAA Privacy and Security Complaint Form Package (complaint and consent forms). https://www.hhs.gov/sites/default/files/ocr-hip-security-complaint-form-package.pdf
- eCFR, 45 CFR 160.316, Refraining from intimidation or retaliation. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-C/section-160.316
- eCFR, 45 CFR 164.502(j), Disclosures by whistleblowers and workforce member crime victims. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
- eCFR, 45 CFR 160.310, Responsibilities of covered entities and business associates. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-C/section-160.310
- eCFR, 45 CFR 160.312, Secretarial action regarding complaints and compliance reviews. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-C/section-160.312
- HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2024. https://www.hhs.gov/sites/default/files/compliance-report-to-congress-2024.pdf
- HHS, HIPAA Enforcement. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/index.html
- U.S. Code, 42 U.S.C. 1320d-5, General penalty for failure to comply with requirements and standards, subsection (d). https://www.govinfo.gov/content/pkg/USCODE-2024-title42/html/USCODE-2024-title42-chap7-subchapXI-partC-sec1320d-5.htm
- U.S. Code, 42 U.S.C. 1320d-6, Wrongful disclosure of individually identifiable health information. https://www.govinfo.gov/content/pkg/USCODE-2024-title42/html/USCODE-2024-title42-chap7-subchapXI-partC-sec1320d-6.htm
- eCFR, 45 CFR 164.404, Notification to individuals. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
- eCFR, 45 CFR 164.406, Notification to the media. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.406
- eCFR, 45 CFR 164.408, Notification to the Secretary. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.408
- HHS, Submitting Notice of a Breach to the Secretary. https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html
- eCFR, 45 CFR 164.410, Notification by a business associate. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.410
- eCFR, 45 CFR 164.412, Law enforcement delay. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.412
- eCFR, 45 CFR 164.414, Administrative requirements and burden of proof. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.414
- eCFR, 45 CFR 164.402, Definitions (breach). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.402
- Federal Register, Vol. 65, No. 250, Standards for Privacy of Individually Identifiable Health Information; Final Rule, December 28, 2000, at 65 FR 82566 and 82601. https://www.govinfo.gov/content/pkg/FR-2000-12-28/html/00-32678.htm
FAQ
What proof do you need for a HIPAA violation?
The regulation's minimum is a written complaint that names the organization and describes the acts or omissions you believe broke the rules (2). Your notes on who did what, and when, count as additional information that might help OCR when reviewing your complaint, so add them (3).
How long do you have to report a HIPAA violation?
To file with OCR, you have 180 days from when you knew or should have known about the act or omission, and HHS can waive the limit for good cause (2). An organization's deadline is different. A covered entity notifies affected individuals of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery (23).
Who can file a HIPAA complaint?
HHS states that "Anyone can file a complaint if they believe there has been a violation of the HIPAA Rules or Part 2" (5). You can file for someone else, such as a parent, by adding that person's name to the complaint (3).
Can you report HIPAA violations anonymously?
OCR does not investigate complaints filed without a name and contact information. You can ask on the consent form to keep both confidential during the investigation (3), by checking "CONSENT DENIED," which HHS says is likely to impede the investigation and may result in its closure (14). An organization's own complaint channel may take anonymous reports, depending on how it set up its complaint process.
How do you report a nurse for a HIPAA violation?
Name the nurse's employer, the covered entity, as the subject of the complaint, and describe what the nurse did (2). OCR investigates covered entities and their business associates (5). A nurse who knowingly obtained or disclosed a covered entity's patient information without authorization can be prosecuted personally under 42 U.S.C. 1320d-6 (22). The same steps fit a doctor, a pharmacist, or other hospital staff who violated HIPAA.
Do HIPAA violations need to be reported?
Breaches must be reported, and the organizations involved report them. After a breach of unsecured PHI, a covered entity must notify each affected individual and HHS (23, 25). A business associate must notify the covered entity (27). Covered entities must have written breach notification policies, train workforce members on them, and sanction those who do not comply (12). A staff member follows those policies.
What qualifies as a HIPAA breach?
A breach is an acquisition, access, use, or disclosure of PHI that the Privacy Rule does not permit and that compromises its security or privacy. It is presumed to be a breach unless the covered entity or business associate shows a low probability of compromise through a risk assessment of at least four factors (12). Three exceptions apply, among them a good-faith, unintentional access by a workforce member acting within their authority (30).
Can I sue if HIPAA is violated?
In the 2000 Privacy Rule, HHS wrote that "Under HIPAA, individuals do not have a right to court action" (31). Your HIPAA routes are a complaint to the organization or to OCR and, for residents of a state, a civil action the State Attorney General can bring on their behalf (10). A lawyer in your state can tell you whether another law gives you a claim.
About the author
.avif){kind=small}
Arti Shala
—
ISO 27001:2022 Lead Auditor, HITRUST CCSFP & CHQP
Arti is an experienced cybersecurity and compliance professional with over five years of hands-on experience across IT, security, and GRC. He has worked with clients of all sizes — from startups to Fortune 500s—delivering solutions that improve security posture and ensure compliance.
He began his career supporting healthcare providers with managed IT and security services before transitioning to consulting, where he helps organizations identify risks and strengthen their security programs. Arti is especially skilled at bridging technical depth with executive communication.
His expertise spans risk assessments, compliance audits, and advisory across frameworks including HITRUST, HIPAA, NIST CSF, NIST 800-53, FedRAMP, and ISO 27001. With a focus on healthcare and a strong understanding of cloud, hybrid networks, and DevOps, Arti delivers value to organizations navigating today’s evolving threat landscape.
