How to File a HIPAA Privacy Complaint

By Keith Boone, Healthcare Standards
Twitter: @motorcycle_guy

I’ve been seeing a lot of tweets recently complaining about misuse of HIPAA (about a half-dozen). Mostly from people who know better than doctors what the regulations and legislation actually says.

I tweet back, sometimes cc: @HHSOCR. The volume’s grown enough that I thought it worth while to write a post about it.

If your health care provider or insurer refuses to e-mail you your data, refuses to talk with you over the phone about your health data, or makes it difficult for you, there’s someone who will listen to your complaint and will maybe even take action. The HHS Office of Civil Rights is responsible for investigating complaints about violations of HIPAA. They don’t make the form easy to find (because frankly, they do have limited resources, and do need to filter out stuff that they cannot address), but they do support online complaint filing, and you can get to it online here (I’ve shortcut some of the filtration steps for you, if you’ve found this blog post, you probably meet the filter criteria).

Another way to complain is to write a letter. I know it’s old fashioned, but you can do it. My 8-year-old daughter once wrote a letter to a HIPAA privacy officer. You don’t need to know their name, just the address of the facility, and address it to the HIPAA Privacy Officer. It’ll definitely get someone’s attention. And who knows, you just might change the behavior of the practice (my daughter’s letter got the practice to change a form used to report on a visit so that it would be clearer for patients).

I’ve mentioned before that under the HIPAA Omnibus regulations, in combination with recent certification requirements, providers shouldn’t be able to give the excuse that they are not allowed (under HIPAA) to e-mail, or haven’t set up the capability to e-mail you your health data. Those two statements are likely to be false … but most providers don’t know that (if you are reading this blog, you are probably among the exceptions).

I’d love it if HHS OCR provided a simple service that made it possible for patient’s to report HIPAA nuisance behavior that would a) send the provider a nasty-gram addressed to the HIPAA Privacy officer at the institution with an official HHS logo on the front cover, and b) track the number of these sent to providers based on patient reports, and c) publicly report the number of nastygrams served to instititions when it reached a certain limit within a year, and d) do a more formal investigation when the number gets over a threshold, and e) tell them all that in short declarative statements:

e.g.,

To whom it may concern,

On (date) a patient reported that (name) or one their staff informed them incorrectly about HIPAA limitations.

The patient was informed that:
[ ] Healthcare data cannot be e-mailed to them.
[ ] Healthcare data cannot be faxed to them.
[ ] Healthcare data cannot be sent to a third party they designate.
… (a bunch of check boxes)

Please see HHS Circular (number) regarding your responsibilities regarding patient privacy rights.

Things you are allowed to do:
… (another laundry list).

This is the (number)th complain this year this office has received about your organization. After (x) complaints in a year, your organization will be reported on http://www.hhs.gov/List-Of-Privacy-Nuisance-Violators.html. After (y) complaints total, your organization will be investigated and audited.

Sincerely,

Somebody with an Ominous Sounding Title (i.e., Chief investigator)
/s/

I’d also love it if HHS would require the contact information for the privacy officer be placed on every stupid HIPAA acknowledgement form I’ve been “required” to sign (acknowledging I’ve been given the HIPAA notice … which inevitably I refuse to sign until I get it), and on every HIPAA notice form I’m given. Because I’d fricken use it.

I could go on for quite some time about the pharmacy that couldn’t find their HIPAA notice for ten minutes and refused to give me my prescription because I refused to sign the signature pad until they did so, only for them to finally discover that if they’d just given me the prescription, I would see it written on the back of the information form they give out with every medication … but they didn’t have a clue until someone made a phone call. And of course they claimed I had to sign because “HIPAA” (which says no such thing).

I’d also love it if HSS authorized some sort of “secret healthcare shopper” that registered for random healthcare visits and audited the HIPAA components of a provider’s intake processes for improvements (e.g., the HIPAA form in 6-point type at an eye doctor’s office is one of my favorite stories, that’s a potential violation of both HIPAA and disability regulations). What the hell, make the payers actually be the ones responsible do it with some percentage of their contracted provider organizations, and report the results to HHS on a periodic basis.

I think this would allow us (patients) to fight back with nuisances of our own which could eventually have teeth if made widely available and known to patients. I’m sorry I didn’t think to put this in with my recent HIPAA RFI comments. Oh well, perhaps another day, and in fact, since there was an RFI, there will be an NPRM, so these comments could be made there, and who knows, perhaps someone will even act on them. I’ve had some success with past regulatory comments before.

This article was originally published on Healthcare Standards and is republished here with permission.