Health Information Privacy Complaint Form

Form Approved: OMB No. 0945-0002.
Expiration Date:04/30/2022

DEPARTMENT OF HEALTH AND HUMAN SERVICES

OFFICE FOR CIVIL RIGHTS (OCR)

HEALTH INFORMATION PRIVACY & SECURITY COMPLAINT
YOUR FIRST NAME

YOUR LAST NAME

HOME PHONE (Please include area code)

WORK PHONE (Please include area code)

STREET ADDRESS

STATE

CITY

ZIP

E-MAIL ADDRESS (If available)

Are you filing this complaint for someone else?
Yes
No
If Yes, whose health information privacy rights do you believe were violated?
FIRST NAME

LAST NAME

Who (or what agency or organization, e.g., provider, health plan) do you believe violated your (or someone else’s) health
information privacy rights or committed another violation of the Privacy Rule or Security Rules?
PERSON / AGENCY / ORGANIZATION

STREET ADDRESS

STATE

CITY

ZIP

PHONE (Please include area code)

When do you believe that the violation of health information privacy rights occurred?
LIST DATE(S)

Describe briefly what happened. How and why do you believe your (or someone else’s) health information privacy rights were
violated, or how another violation of the Privacy or Security Rules occurred? Please be as specific as possible.
(Attach additional pages as needed)

Please sign and date this complaint. You do not need to sign if submitting this form by email because submission by email represents your signature.

SIGNATURE

DATE (mm/dd/yyyy)

Filing a complaint with OCR is voluntary. However, without the information requested above, OCR may be unable to proceed with your
complaint. We collect this information under authority 45 CFR 160 & 164 issued pursuant to the Health Insurance Portability and
Accountability Act of 1996. We will use the information you provide to determine if we have jurisdiction and, if so, how we will process your
complaint. Information submitted on this form is treated confidentially and is protected under the provisions of the Privacy Act of 1974.
Names or other identifying information about individuals are disclosed when it is necessary for investigation of possible health information
privacy violations, for internal systems operations, or for routine uses, which include disclosure of information outside the Department for
purposes associated with health information privacy compliance and as permitted by law. It is illegal for a covered entity to intimidate,
threaten, coerce, discriminate or retaliate against you for filing this complaint or for taking any other action to enforce your rights under the
Privacy Rule. You are not required to use this form. You also may write a letter or submit a complaint electronically with the same
information. To submit an electronic complaint, go to OCR’s Web site at: www.hhs.gov/ocr/privacy/hipaa/complaints/index.html. To
mail a complaint see page 2 of this form for the mailing address.
HHS-700 (03/2019)(FRONT)

The remaining information on this form is optional. Failure to answer these voluntary
questions will not affect OCR's decision to process your complaint.
Do you need special accommodations for OCR to communicate with you about this complaint? (Check all that apply)
Braille

Computer

Large Print

Electronic Mail

Other (specify): _______________________________

TDD

Sign language interpreter (specify language):
Foreign language interpreter (specify language):

If we cannot reach you directly, is there someone we can contact to help us reach you?
FIRST NAME

LAST NAME

HOME PHONE (Please include area code)

WORK PHONE (Please include area code)

STREET ADDRESS

CITY

STATE

ZIP

E-MAIL ADDRESS (If available)

Have you filed your complaint anywhere else? If so, please provide the following. (Attach additional pages as needed)
PERSON / AGENCY / ORGANIZATION / COURT NAME(S)

DATE(S) FILED

CASE NUMBER(S) (If known)

To help us better serve the public, please provide the following information for the person you believe had their health
information privacy rights violated (you or the person on whose behalf you are filing).
ETHNICITY (select one)

RACE (select one or more)

Hispanic or Latino

American Indian or Alaska Native

Asian

Native Hawaiian or Other Pacific Islander

Not Hispanic or Latino

Black or African American

White

Other (specify):

PRIMARY LANGUAGE SPOKEN (if other then English)

How did you learn about the Office for Civil Rights?
HHS Website/Internet Search
Fed/State/Local Gov

Family/Friend/Associate

Healthcare Provider/Health Plan

Religious/Community Org

Lawyer/Legal Org

Conference/OCR Brochure

Customer Resp Cntr

Employer

Other (specify):

To submit a complaint, please type or print, sign, and return completed complaint form package (including consent form) to the
OCR Headquarters address below.

U.S. Department of Health and Human Services
Office for Civil Rights

Centralized Case Management Operations

200 Independence Ave., S.W.

Suite 515F, HHH Building

Washington, D.C. 20201

Customer Response Center: (800) 368-1019

Fax: (202) 619-3818

TDD: (800) 537-7697

Email: ocrmail@hhs.gov

Burden Statement
Public reporting burden for the collection of information on this complaint form is estimated to average 45 minutes per response, including the time for reviewing
instructions, gathering the data needed and entering and reviewing the information on the completed complaint form. An agency may not conduct or sponsor,
and a person is not required to respond to, a collection of information unless it displays a valid control number. Send comments regarding this burden estimate
or any other aspect of this collection of information, including suggestions for reducing this burden, to: HHS/OS Reports Clearance Officer, Office of Information
Resources Management, 200 Independence Ave. S.W., Room 531H, Washington, D.C. 20201. Please do not mail this complaint form to this address.
HHS-700 (03/2019) (BACK)

Form Approved: OMB No. 0945-0002
Expiration Date: 04/30/2022

COMPLAINANT CONSENT FORM
The Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR)
has the authority to collect and receive material and information about you, including
personnel and medical records, when they are relevant to its investigation of your
complaint.
To investigate your complaint, OCR may need to reveal your identity or identifying
information about you to persons at the entity or agency under investigation or to other
persons, agencies, or entities. In some circumstances, OCR may refer your complaint to
another government agency, as warranted.
The Privacy Act of 1974 protects certain federal records that contain personally
identifiable information about you and, with your consent, allows OCR to use your name
or other personal information, if necessary, to investigate your complaint.
Consent is voluntary, and it is not always needed in order to investigate your complaint;
however, failure to give consent is likely to impede the investigation of your complaint
and may result in the closure of your case.
Additionally, OCR may disclose information, including medical records and other
personal information, which it has gathered during the course of its investigation in
order to comply with a request under the Freedom of Information Act (FOIA) and may
refer your complaint to another appropriate agency.
Under FOIA, OCR may be required to release information regarding the investigation
of your complaint; however, we will make every effort, as permitted by law, to protect
information that identifies individuals or that, if released, could constitute a clearly
unwarranted invasion of personal privacy.
OCR will use any applicable protections in that law to safeguard information which
could identify you, or other individuals, or that, if released, could constitute a clearly
unwarranted invasion of personal privacy. OCR may be required to release some
information regarding the investigation of your complaint under the Freedom of
Information Act (FOIA), however, information concerning your complaint which could
reveal your identity is protected from disclosure to third party requesters under FOIA.
Please read and review the documents entitled Notice to Complainants and Other
Individuals Asked to Supply Information to the Office for Civil Rights and Protecting
Personal Information in Complaint Investigations for further information regarding how
OCR may obtain, use, and disclose your information while investigating your complaint.
In order to expedite the investigation of your complaint if it is accepted by OCR,
please read, sign, and return one copy of this consent form to OCR with your
complaint. Please make one copy for your records.
Complaint Consent Form

Page 1 of 6

Form Approved: OMB No. 0945-0002
Expiration Date: 04/30/2022

•

As a complainant, I understand that in the course of the investigation of my
complaint it may become necessary for OCR to reveal my identity or identifying
information about me to persons at the entity or agency under investigation or to
other persons, agencies, or entities.

•

I am also aware of the obligations of OCR to honor requests under the Freedom of
Information Act (FOIA). I understand that it may be necessary for OCR to
disclose general information which it has gathered as part of its investigation of
my complaint, excluding personally identifiable information.

•

In addition, I understand that, as a complainant, I may be covered by the
Department of Health and Human Services’ (HHS) regulations which protect any
individual from being intimidated, threatened, coerced, retaliated against, or
discriminated against because he/she has made a complaint, testified, assisted, or
participated in any manner in any mediation, investigation, hearing, proceeding,
or other part of HHS’s investigation, conciliation, or enforcement process.

After reading the above information, please check ONLY ONE of the following boxes:

CONSENT: I have read, understand, and agree to the above and give permission
to OCR to reveal my identity or identifying information about me in my case file to
persons at the entity or agency under investigation or to other relevant persons,
agencies, or entities during any part of HHS’ investigation, conciliation, or
enforcement process.

CONSENT DENIED : I have read and I understand the above and do not give
permission to OCR to reveal my identity or identifying information about me. I
understand that this denial of consent is likely to impede the investigation of my
complaint and may result in closure of the investigation.

Signature:

Date:

*Please sign and date this complaint. You do not need to sign if submitting this form by email because submission by email represents your signature.

Name (Please print):

Address:

Telephone Number:

Complaint Consent Form

Page 2 of 6

Form Approved: OMB No. 0945-0002
Expiration Date: 04/30/2022

NOTICE TO COMPLAINANTS AND OTHER
INDIVIDUALS ASKED TO SUPPLY INFORMATION
TO THE OFFICE FOR CIVIL RIGHTS
Privacy Act
The Privacy Act of 1974 (5 U.S.C. §552a) requires OCR to notify individuals whom it
asks to supply information that:
— OCR is authorized to solicit information under:
(i) Federal laws barring discrimination by recipients of Federal financial assistance on
grounds of race, color, national origin, disability, age, sex, religion under programs and
activities receiving Federal financial assistance from the U.S. Department of Health and
Human Services (HHS), including, but not limited to, Title VI of the Civil Rights Act of
1964 (42 U.S.C. §2000d et seq.), Section 504 of the Rehabilitation Act of 1973 (29
U.S.C. §794), the Age Discrimination Act of 1975 (42 U.S.C. §6101 et seq.), Title IX of
the Education Amendments of 1972 (20 U.S.C. §1681 et seq.), Sections 794 and 855 of
the Public Health Service Act (42 U.S.C. §§295m and 296g); and Section 1557 of the
Affordable Care Act (42 U.S.C. §18116);
(ii) Federal laws protecting rights of conscience and religious freedom in health and
human services programs, such as Sections 1303(b)(4) and 1553 of the Affordable Care
Act (42 U.S.C. §§18113, 18023(b)(4)), the Church Amendments (42 U.S.C. § 300a-7),
the Coats-Snowe Amendment (42 U.S.C §238n), the Religious Freedom Restoration
Act (42 U.S.C. § 2000bb et seq.), and the Weldon Amendment (e.g., Departments of
Labor, Health and Human Services, and Education, and Related Agencies
Appropriations Act, 2019, Pub. L. No. 115-245, Div. B., §507(d)), and applicable
regulations;
(iii) Titles VI and XVI of the Public Health Service Act (42 U.S.C. §§291 et seq. and 300s
et seq.) and 42 C.F.R. Part 124, Subpart G (Community Service obligations of HillBurton facilities);
(iv) 45 C.F.R. Part 85, as it implements Section 504 of the Rehabilitation Act in programs
conducted by HHS; and
(v) Title II of the Americans with Disabilities Act (42 U.S.C. §12131 et seq.) and
Department of Justice regulations at 28 C.F.R. Part 35, which give HHS “designated
agency” authority to investigate and resolve disability discrimination complaints against
certain public entities, defined as health and service agencies of state and local
governments, regardless of whether they receive federal financial assistance.
HIPAA Standards for the Privacy of Individually Identifiable Health Information (The
Privacy Rule), 45 C.F.R. Part 160 and Subparts A and E of Part 164, Health Insurance
Reform: Security Standards (The Security Rule), 45 C.F.R. Part 160 and Subparts A and
C of Part 164, Breach Notification for Unsecured Protected Health Information (The
Breach Rule), 45 C.F.R. Part 160 and Subparts A and D of Part 164, and Administrative
Simplification: Enforcement, 45 C.F.R. Part 160, Subparts C, D, and E, which contains
provisions relating to compliance and investigations, the imposition of civil money
penalties, and procedures for hearings related to violations of the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. §1320d-2).
Complaint Consent Form

Page 3 of 6

Form Approved: OMB No. 0945-0002
Expiration Date: 04/30/2022

OCR will request information for the purpose of determining and securing compliance
with the Federal laws listed above. Disclosure of this requested information to OCR by
individuals who are not recipients of federal financial assistance is voluntary; however,
even individuals who voluntarily disclose information are subject to prosecution and
penalties under 18 U.S.C. § 1001 for making false statements.
Additionally, although disclosure is voluntary for individuals who are not recipients of
federal financial assistance, failure to provide OCR with requested information may
preclude OCR from making a compliance determination or enforcing the laws above.
OCR has the authority to disclose personal information collected during an investigation
without the individual’s consent for the following routine uses:
(i) to make disclosures to OCR contractors who are required to maintain Privacy Act
safeguards with respect to such records;
(ii) for disclosure to a congressional office from the record of an individual in response to
an inquiry made at the request of the individual;
(iii) to make disclosures to the Department of Justice to permit effective defense of
litigation; and
(iv) to make disclosures to the appropriate agency in the event that records maintained by
OCR to carry out its functions indicate a violation or potential violation of law.
Under 5 U.S.C. §552a(k)(2) and the HHS Privacy Act regulations at 45 C.F.R. §5b.11
OCR complaint records have been exempted as investigatory material compiled for law
enforcement purposes from certain Privacy Act access, amendment, correction and
notification requirements.
Freedom of Information Act
A complainant, the recipient or any member of the public may request release of OCR
records under the Freedom of Information Act (5 U.S.C. §552) (FOIA) and HHS
regulations at 45 C.F.R. Part 5. Generally, most records will be available only to the
complainant if they are not privileged. Most or all records from a complaint file will be
withheld to protect privacy.
Fraud and False Statements
Federal law, at 18 U.S.C. §1001, authorizes prosecution and penalties of fine or
imprisonment for conviction of “whoever, in any matter within the jurisdiction of any
department or agency of the United States knowingly and willfully falsifies, conceals or
covers up by any trick, scheme, or device a material fact, or makes any false, fictitious or
fraudulent statements or representations or makes or uses any false writing or document
knowing the same to contain any false, fictitious, or fraudulent statement or entry.”

Complaint Consent Form

Page 4 of 6

Form Approved: OMB No. 0945-0002
Expiration Date: 04/30/2022

PROTECTING PERSONAL INFORMATION IN
COMPLAINT INVESTIGATIONS
To investigate your complaint, the Department of Health and Human Services’ (HHS)
Office for Civil Rights (OCR) will collect information from different sources. Depending
on the type of complaint, we may need to get copies of your medical records, or other
information that is personal to you. This Fact Sheet explains how OCR protects your
personal information that is part of your case file.
HOW DOES OCR PROTECT MY PERSONAL INFORMATION?
OCR is required by law to protect your personal information. The Privacy Act of 1974
protects Federal records about an individual containing personally identifiable
information, including, but not limited to, the individual’s medical history, education,
financial transactions, and criminal or employment history that contains an individual’s
name or other identifying information.
Under the Privacy Act, OCR will disclose your name or other personal information with a
signed consent from you, and only when it is necessary to complete the investigation of
your complaint or to enforce civil rights laws or when it is otherwise permitted by law.
Consent is voluntary, and it is not always needed in order to investigate your complaint;
however, failure to give consent is likely to impede the investigation of your complaint
and may result in the closure of your case.
CAN I SEE MY OCR FILE?
Under the Freedom of Information Act (FOIA), you can request a copy of your case file
once your case has been closed; however, OCR can withhold information from you in
order to protect the identities of witnesses and other sources of information. Additionally,
some records may be withheld to protect OCR’s deliberative process privilege or any
other legally protected privilege.
CAN OCR GIVE MY FILE TO ANY ONE ELSE?
If a complaint indicates a violation or a potential violation of law, OCR can refer the
complaint to another appropriate agency without your permission.
If you file a complaint with OCR, and we decide we cannot help you, we may refer your
complaint to another agency, such as the Department of Justice.
CAN ANYONE ELSE SEE THE INFORMATION IN MY FILE?
Public access to OCR’s files and records is controlled by the Freedom of Information Act
(FOIA). Under FOIA, OCR may be required to release general information about this
case upon public request. In the event that OCR receives such a request, we will apply
every legal protection to information that identifies individuals.
Complaint Consent Form

Page 5 of 6

Form Approved: OMB No. 0945-0002
Expiration Date: 04/30/2022

If OCR receives protected health information about you in connection with a HIPAA
investigation or compliance review, we will only share this information with individuals
outside of HHS if necessary for our compliance efforts or if we are required to do so by
another law.
DOES IT COST ANYTHING FOR ME (OR SOMEONE ELSE) TO OBTAIN A
COPY OF MY FILE?
In most cases, the first two hours spent searching for document(s) you request under the
Freedom of Information Act and the first 100 pages are free. Additional search time or
copying time may result in a cost for which you will be responsible. If you wish to limit
the search time and number of pages to a maximum of two hours and 100 pages; please
specify this in your request. You may also set a specific cost limit, for example, cost not
to exceed $100.00. For details, see HHS’s FOIA page.
If you have any questions about this complaint and consent package, please contact
OCR at www.hhs.gov/ocr/office/about/contactus/index.html.
OR
Contact the Customer Response Center at (800) 368-1019 (see contact information on
page 2 of the Complaint Form).

Complaint Consent Form

Page 6 of 6