How Do I File a HIPAA Complaint?
You file a HIPAA complaint with the HHS Office for Civil Rights, in writing, generally within 180 days of when you knew the violation occurred. The complaint needs to name the organization, describe what happened and when, and be filed by you or someone acting on your behalf. It can be submitted through the OCR complaint portal, by mail, or by email, and there is no filing fee. The 180-day deadline is the part that trips people up: it can be extended for good cause, but the most common reason complaints are never filed is that months of trying to resolve things directly quietly consumed the window. Before you file, escalate internally to the organization’s privacy officer, since that resolves a large share of access problems faster than a federal complaint will. Then file if it does not.
What can I actually complain about?
Anything a HIPAA-covered organization did that the rules do not permit. In practice, patient complaints cluster into a few types.
Right-of-access failures are the most common by a wide margin: records not provided within the timeline, an improper refusal, an excessive fee, a request that vanished, or a denial the organization will not explain.
Amendment failures — a correction request ignored, or denied without the written explanation and the chance to file a statement of disagreement.
Improper disclosures — your information shared with someone who should not have received it.
Complaints must be against a covered entity (health plans, most providers, health care clearinghouses) or a business associate acting for one. Many organizations that hold health-adjacent data are neither, and a complaint about them belongs somewhere other than OCR.
What should the complaint include?
Specificity is what makes a complaint actionable, and vagueness is what makes it stall.
Include the organization’s full legal name and address, the dates things happened, and a plain chronological account of what you requested, when, who you spoke to, and what they said. Attach copies of what you sent and anything you received back — the request form, the denial letter, the fee quote, the email thread.
Say clearly what rule you believe was broken and what you want. “I requested my complete record on March 3, received no response, followed up on March 24 and April 10, and as of today have received nothing” is a complaint someone can investigate. “They have been unhelpful” is not.
Keep a copy of everything you file.
How do I file it?
Through the OCR complaint portal at hhs.gov, or by mail or email to the OCR regional office covering your state. The portal is the fastest route and gives you a tracking number, which is worth having.
You will be asked whether you consent to OCR sharing your name with the organization. Investigating an access complaint almost always requires it, since the organization has to look up your specific request. Anonymity and resolution are largely incompatible here.
If you need language assistance or an accommodation to file, OCR is required to provide it — ask rather than letting it become the reason you do not file.
What happens after I file?
OCR reviews the complaint for jurisdiction and timeliness first. Not everything gets a full investigation; many complaints are closed at intake because they fall outside HIPAA, name an organization that is not covered, or arrive after the deadline.
If it proceeds, OCR typically contacts the organization, which usually responds by producing the records or fixing the problem. Most right-of-access matters end in voluntary compliance — the outcome you actually wanted — rather than a penalty. Formal enforcement actions and settlements happen, but they are the exception and they take considerably longer.
Timelines vary a great deal. Some access complaints resolve in weeks because the organization simply releases the records once contacted. Others take many months.
What won’t filing get me?
Money. A HIPAA complaint is not a claim for compensation, and HIPAA gives individuals no private right of action — you cannot sue a provider under HIPAA itself. Penalties collected in enforcement actions go to the government, not to the person who complained.
It also is not fast enough to be your only move if you have a real deadline — a surgery, a disability determination, a legal filing. File the complaint, but keep pursuing the records directly at the same time. The two are not alternatives.
Retaliation for filing is prohibited. If care changes after you complain, that is itself something to document and report.
Should I file, or is it not worth it?
File, if you have a genuine access problem the organization would not fix.
Right-of-access enforcement has been a stated OCR priority for years, and the pattern that emerges from complaints is what drives it. A single unanswered request looks like an isolated failure from the inside; twenty of them look like a broken process. Your complaint is one of the twenty.
There is also a narrower reason. Filing frequently gets the records released, because the fastest way for an organization to resolve an access complaint is to do the thing it should have done in the first place.
Organized.health helps you organize your health information. It does not provide medical advice, diagnosis, or treatment. Always talk to a qualified healthcare provider about your care.
Related: Can a doctor refuse to give me my medical records? · How do I correct an error in my medical record? · Filing a HIPAA complaint
