Form CMS-10148 - HIPAA Non-Privacy Complaint Form

_{Form Approved: OMB # 0938-0948}

_{C enters for Medicare & Medicaid Services (CMS)}

_{Office of E-Health Standards and Services (OESS)}

HIPAA Non-Privacy Complaint Form

IMPORTANT: This form cannot be used for HIPAA Privacy complaints. Please direct privacy complaints to the Office for Civil Rights at 1-800-368-1019 or visit their website: www.hhs.gov/ocr/hipaa

If you have general questions about the HIPAA Regulations visit our website at: www.cms.hhs.gov

Please provide your contact information: (All fields required.)

YOUR NAME (First and Last) ORGANIZATION NAME

STREET ADDRESS TELEPHONE NUMBER

CITY/TOWN COUNTY STATE ZIP

Who (or what agency/organization, e.g. health care clearinghouse, health plan, or covered health care provider) are you filing this complaint against? (All fields required.)

ORGANIZATION NAME CONTACT NAME

STREET ADDRESS TELEPHONE NUMBER

CITY/TOWN COUNTY STATE ZIP

When did this alleged violation occur? mm/dd/yyyy (Required field.)

Identify the HIPAA Non-Privacy complaint category? (Required field.) Select one regulatory category listed below per complaint submission. Complete this form again to file a complaint for another category listed below.

Transactions and Code Sets

Unique Identifiers

Security Standards

Describe, in detail, the alleged violation. (Required field.) You may attach additional pages as needed. Please enclose copies of any additional documents (e.g. companion guide, security risk assessment) that may help OESS resolve your complaint.

Please Print or Type.

Please sign and date this complaint. (Required field.)

SIGNATURE:

DATE:

Filing a complaint with CMS is voluntary. However, without the information requested on the complaint form, CMS may be unable to proceed with a complaint. CMS collects this information under authority of 68 FR 60694 (October 23, 2003) issued pursuant to the HIPAA. CMS will use the information provided to determine if CMS has jurisdiction and, if so, how CMS will process the complaint. Information submitted on the complaint form is treated confidentially and is protected under the provisions of the Privacy Act of 1974. Names or other identifying information about individuals are disclosed only when it is necessary for investigation of possible HIPAA A.S. Non‑Privacy violations, for internal systems operations, or for routine uses, which include disclosure of information outside the Department for purposes associated with HIPAA A.S. Non‑Privacy compliance and as permitted by law. To submit an electronic complaint, go to our web site at: http://htct.hhs.gov

IMPORTANT: The information requested in the remainder of this form is optional. However, any additional information you provide will assist OESS in the enforcement process.
OPTIONAL INFORMATION
Have you filed this complaint with another agency? If so, please provide us with the following:
Agency Name:	Agency Contact Person:
Date the Complaint was Filed:	Contact Number:
Complaint Identification Number:
Please provide OESS with more detail about this complaint.
Please describe yourself. Health Plan Covered Health Care Provider (See examples on the right) Health Care Clearinghouse Patient or representative of the patient Other:____________________________ Who are you filing this complaint against? Health Plan Covered Health Care Provider (See examples on the right) Health Care Clearinghouse Have you attempted to resolve the dispute? YES NO	Examples of Covered Health Care Providers: Ambulance Service Comprehensive Outpatient Rehabilitation Facility Durable Medical Equipment Service Home Health Agency Hospice Program Hospital / Critical Access Hospital Non-Physician Practitioners Outpatient Physical or Occupational Therapy Physician Rural Health Clinics and Federally Qualified Health Centers Skilled Nursing Facility
For a Transactions and Code Sets Complaint (Check the appropriate box.)
Non-Compliant Transaction Received - You received a non-compliant HIPAA transaction from a covered entity. Compliant Transaction Sent and Rejected - A covered entity rejected your compliant HIPAA transaction. Invalid Companion Guide - A covered entity that you send data to or receive data from requires uses of a non-compliant companion guide. For example, a companion guide must not specify additional fields beyond those specified by HIPAA. Code Set Received or Sent and Rejected: - Either or both of these examples may apply: (1) A covered entity sent you a non-compliant HIPAA code within an electronic transaction. (2) A covered entity rejected a compliant HIPAA code that you sent within an electronic transaction. Other - You have another type of complaint against a covered entity.
Disclosure Statement: According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is 0938-0948. The time required to complete this information collection is estimated to average 1 hour per response, including the time to review instructions, search existing data resources, gather the data needed, and complete and review the information collection. If you have comments, concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Baltimore, Maryland 21244-1850.

IMPORTANT: The information requested in the remainder of this form is optional. However, any additional information you provide will assist OESS in the enforcement process.

OPTIONAL INFORMATION

For a Transactions and Code Sets Complaint (Check the appropriate box.)

1. Check the appropriate transaction(s) discussed in your complaint. Note: If your complaint involves a transaction(s) that is not listed, you may not have a valid transaction complaint.

270 Eligibility, Coverage or Benefit Inquiry	837 Health Care Claim: Dental	835 Health Care Claim Payment/Advice
271 Eligibility, Coverage or Benefit Information	837 Health Care Claim: Professional	820 Health Plan Premium Payments
276 Health Care Claim Status Request	837 Health Care Claim: Institutional	278 Health Care Services Review - Request for Review
277 Health Care Claim Status Response	834 Benefit Enrollment and Maintenance	278 Health Care Services Review - Response to Request for Review
NCPDP Retail Pharmacy Transactions	Not Sure

2. Check the appropriate code set(s) discussed in your complaint.

International Classification of Diseases, 9th Edition, Clinical Modification (ICD-9-CM)	Healthcare Common Procedure Coding System (HCPCS)
Common Procedure Terminology (CPT)	National Drug Code (NDC)
Codes on Dental Procedures and Nomenclature - Current Dental Terminology (CDT)	Other:________________________________

For a Security Complaint (Check the appropriate box.)

Do you believe that personal health information was wrongfully shared or disclosed, or that the action you are complaining about otherwise violated the health information Privacy Rule?

• YES

• NO

For a Unique Identifier Complaint (Check the appropriate box.)

What type of Identifier does your complaint relate to?

• National Provider Identifier (NPI)

• Employer Identification Number (EIN)

Mail completed forms to:

Centers for Medicare & Medicaid Services HIPAA Enforcement Activities P.O. Box 8030 Baltimore, Maryland 21244-8030

Disclosure Statement: According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is 0938-0948. The time required to complete this information collection is estimated to average 1 hour per response, including the time to review instructions, search existing data resources, gather the data needed, and complete and review the information collection. If you have comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Baltimore, Maryland 21244-1850.

2