Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification (A.S.) Complaint Form

_{Centers for Medicare & Medicaid Services (CMS)}

_{National Standards Group}

H IPAA Non-Privacy Enforcement Information

Please read the following before filing a complaint with CMS

The Department of Health and Human Services (HHS) delegated authority to Centers for Medicare & Medicaid Services (CMS) for enforcement of HIPAA Administrative Simplification regulations for Transactions and Code Sets, Unique Identifiers, and Security Standards. Specifically, the Program Management National Standards Group (PMNSG)), a CMS office, has the authority to investigate complaints of noncompliance with, and to make decisions regarding the interpretation, implementation, and enforcement of the HIPAA regulations except the Privacy and Security Rules. Within CMS, PMNSG operates as a separate entity from CMS' Medicare and Medicaid related activities.

T

IMPORTANT: This form cannot be used for HIPAA Privacy and Security complaints. Please refer privacy complaints to the Office for Civil Rights at 1-800-368-1019 or visit their website:

www.hhs.gov/ocr/hipaa

he HIPAA enforcement process is primarily complain- driven and consists of progressive steps that provide covered entities opportunities to demonstrate compliance, obtaining voluntary compliance through technical assistance, or submit a corrective action plan. The regulation defines a covered entity as a health plan, health care provider who transmits any health information in electronic form in connection with a covered transaction and health care clearinghouse.

Complaints to PMNSG must: (1) be filed in writing either on paper or electronically; (2) describe the acts or omissions believed to be in violation of the applicable administrative simplification provisions; (3) provide contact information, including name, address, and telephone number, for the complainant and the covered entity that are the subject of the complaint; (4) be filed within 180 days of when the complainant knew or should have known that the act or omission that is the subject of the complaint occurred. CMS may waive this time limit for good cause shown. PMNSG developed a paper complaint form to assist those interested in submitting a paper complaint. If you have Internet access, PMNSG strongly encourages you to use the Administrative Simplification Enforcement and Testing Tool (ASETT) – a web based complaint submission system that located at https://htct.hhs.gov/asett/public/banner.act. ASETT allows the user to file a complaint, upload files to support the complaint, and update the complaint during an investigation. Please note that PMNSG does not accept complaints filed via fax or email to ensure privacy of the information within the complaint. Mail completed forms to:

Centers for Medicare & Medicaid Services
HIPAA Enforcement Activities
P.O. Box 8030
Baltimore, Maryland 21244-8030

A person who believes that a covered entity is not complying with the applicable administrative simplification provisions may file a complaint with CMS. PMNSG encourages voluntary compliance and requests that attempts be made to resolve disputes by working with the covered entity and/or consulting various HIPAA resources. For technical assistance on specific Transactions,Code Sets, Unique Identifiers, and/or Operating Rule issues, refer to the official HIPAA Implementation Guides available for download at the Washington Publishing Company website at www.wpc-edi.com. The Implementation Guides for the National Council for Prescription Drug Programs’ (NCPDP) retail pharmacy transactions are available at www.ncpdp.org.

Who can file a HIPAA Non-Privacy complaint?

Anyone can file a HIPAA Non-Privacy complaint. However, if you have questions, concerns, or would like clarification on HIPAA related issues, you should contact PMNSG for help. See our website for additional information at www.cms.hhs.gov/hipaa.

PRA Disclosure Statement

According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number.  The valid OMB control number for this information collection is 0938-0948 (CMS-10148).The expiration date is XX/XX/XXXX.  The time required to complete this information collection is estimated to average 1 hour per response, including the time to review instructions, search existing data resources, gather the data needed, and complete and review the information collection.  If you have comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 21244-1850.