0990-0269Protecting Privacy FINAL

Protecting Personal Information In

Complaint Investigations

To investigate your complaint, the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) will collect information from different sources. Depending on the type of complaint, we may need to get copies of your medical records, or other information that is personal to you. This Fact Sheet explains how OCR protects your personal information that is part of your case file.

HOW DOES OCR PROTECT MY PERSONAL INFORMATION?

OCR is required by law to protect your personal information. The Privacy Act of 1974 protects Federal records about an individual containing personally identifiable information, including, but not limited to, the individual’s medical history, education, financial transactions, and criminal or employment history that contains an individual’s name or other identifying information.

Because of the Privacy Act, OCR will use your name or other personal information with a signed consent and only when it is necessary to complete the investigation of your complaint or to enforce civil rights laws or when it is otherwise permitted by law.

Consent is voluntary, and it is not always needed in order to investigate your complaint; however, failure to give consent is likely to impede the investigation of your complaint and may result in the closure of your case.

CAN I SEE MY OCR FILE?

Under the Freedom of Information Act (FOIA), you can request a copy of your case file once your case has been closed; however, OCR can withhold information from you in order to protect the identities of witnesses and other sources of information.

CAN OCR GIVE MY FILE TO ANY ONE ELSE?

If a complaint indicates a violation or a potential violation of law, OCR can refer the complaint to another appropriate agency without your permission.

If you file a complaint with OCR, and we decide we cannot help you, we may refer your complaint to another agency such as the Department of Justice.

CAN ANYONE ELSE SEE THE INFORMATION IN MY FILE?

Access to OCR’s files and records is controlled by the Freedom of Information Act (FOIA). Under FOIA, OCR may be required to release information about this case upon public request. In the event that OCR receives such a request, we will make every effort, as permitted by law, to protect information that identifies individuals, or that, if released, could constitute a clearly unwarranted invasion of personal privacy.

If OCR receives protected health information about you in connection with a HIPAA Privacy Rule investigation or compliance review, we will only share this information with individuals outside of HHS if necessary for our compliance efforts or if we are required to do so by another law.

DOES IT COST ANYTHING FOR ME (OR SOMEONE ELSE) TO OBTAIN A COPY OF MY FILE?

In most cases, the first two hours spent searching for document(s) you request under the Freedom of Information Act and the first 100 pages are free. Additional search time or copying time may result in a cost for which you will be responsible. If you wish to limit the search time and number of pages to a maximum of two hours and 100 pages; please specify this in your request. You may also set a specific cost limit, for example, cost not to exceed $100.00.

If you have any questions about this fact sheet, please contact OCR http://www.hhs.gov/ocr/contact.html

OR

Contact your OCR Regional Office

(see Regional Office contact information on page 2 of the Complaint Form)

Page 2 of 2