HIPAA Complaint Instructions

If a facility refuses to provide your full records, please use this guide to file a HIPAA complaint to The Office of Civil Rights (OCR). Use this ONLY after you have formally requested your records and have been denied or refused.

Please note, you must give a facility 30 days to send your records. You may visit this site to understand your rights to access records. 

What you will need

  1. PDFs of all emails between the facility and the requestor regarding the records request. To create a PDF of an email, begin by clicking the print icon. Instead of picking a “destination” that is a printer, select “Save as PDF”.
    1. This will be easier on a computer than on a phone.
    2. Also be sure to save any other PDFs related to your records request such as any forms the facility sent you (even if you did not sign them).
  2. All dates of email correspondence
  3. A written summary of what you believe is relevant to your complaint.
  4. The address of the facility.

Filing the complaint

1. Navigate to https://ocrportal.hhs.gov/ocr/cp/wizard_cp.jsf, click the File a Health Information Privacy Complaint link, and enter your information.

2. Choose the Agency/Organization radio field and type the name of the facility.

3. Enter the rest of the facility’s information including address and phone number. Be sure to use the facility’s full legal name, not an abbreviation.

4. For the When do you believe that the violation of health information privacy rights occurred? field, enter all dates from email correspondence as violation dates. Add additional dates as needed.

5. Enter your written summary of all events surrounding the denial of the records that you have requested over 30 days ago. Here is what we recommend you include:

  • “I’m filing this complaint because I believe my right to access my own health information has been violated. I was a minor during my enrollment at a behavioral health facility called  [FACILITY NAME] in [CITY, STATE].”
  • Dates of being a client
  • Date of records request(s)
  • Full names of anyone that is relevant to your complaint, their license number if you have it, and their position at the facility.
  • Describe how the facility refused to give you your full electronic record/did not give complete records
  • Note: if the facility uses/used an electronic system for records (for example: BestNotes EHR system)
  • Describe fears of retaliation or any experienced harassment (if applicable).

6. Attach all relevant files (all email PDFs, all release forms from facility, etc)

7. Click next and proceed to finish the rest of the complaint. Click “Other” for how you found the Office for Civil Rights and specify that you found OCR through __________.

8. Complete the Consent

9. Save the complaint as a PDF