Executive summary. A complaint process should make raising a concern safe, preserve the facts, and produce a documented response without retaliation.
Definition
A privacy complaint is a concern raised by an individual about an organization’s privacy practices or handling of protected health information.
Receive the concern respectfully
Give patients and staff a clear way to submit a concern. Record the substance, the contact details, the date, and any immediate facts, without asking the reporter to identify the legal rule.
Acknowledge receipt and explain the next step. Do not promise an outcome before anyone has reviewed the facts.
Close the loop
Assign an owner, gather the relevant records, and keep facts separate from conclusions. Where a change is needed, record the corrective action and who owns it.
Communicate an appropriate outcome to the person who raised the concern, and retain the complaint record under the organization’s policy and legal obligations.
Frequently asked questions
Can a patient complain directly to HHS?
Yes. HHS OCR publishes information about filing a complaint. Organizations should also run their own internal complaint process.
Referenced standards and further reading
- HHS OCR: Filing a Complaint ↗U.S. Department of Health and Human Services
Related articles
HIPAA Security Rule risk analysis: scope, evidence, decisions →
The minimum necessary standard in operational design →
Business associate relationships: map the work, not the logo →