0945-0002 Health Information Privacy and Security Complaint

DEPARTMENT OF HEALTH AND HUMAN SERVICES (HHS)

OFFICE FOR CIVIL RIGHTS (OCR)

HEALTH INFORMATION PRIVACY & SECURITY COMPLAINT

Form Approved: OMB No. 0945-0002

Expiration Date: xx/xx/xxxx

Please indicate one of the following: Mr. Ms. Mx.
YOUR FIRST NAME	PREFERRED PRONOUN	YOUR LAST NAME
PHONE (Please include area code)		PREFERRED DAYS/TIMES TO RECEIVE PHONE CALLS
STREET ADDRESS			CITY
STATE	ZIP	E-MAIL ADDRESS

Have you previously filed a complaint with OCR? Yes No If Yes, please provide OCR Transaction No:

Are you filing this complaint for someone else? Yes No

If yes, whose health information privacy rights do you believe were violated?

FIRST NAME	LAST NAME

If filing on behalf of someone else, what is your relationship to that person?

Parent/Legal Guardian

Personal Representative

Attorney

Family Friend

Other Advocate

OCR will generally need the signed consent of that person to proceed with an investigation unless the person is a minor or is not legally competent. If you have documentation showing that you are legally authorized to act on behalf of the person, please provide supporting documentation.

What agency or organization do you believe violated the Health Information Portability and Accountability Act (HIPAA) Privacy, Security or Breach Notification Rules? Please be aware that OCR does not have authority over individual workforce members.

AGENCY/ORGANIZATION
STREET ADDRESS			CITY
STATE	ZIP	PHONE (Please include area code) E-MAIL ADDRESS

Have you, or the person on whose behalf you are filing, been a client or patient of the agency or organization? Yes No

Have you, or the person on whose behalf you are filing, been an employee of the agency or organization? Yes No

When do you believe that the violation of HIPAA occurred? A complaint must be filed no later than 180 days from when the complainant knew, or should have known, that the act or omission complained of occurred, unless this time limit is waived for good cause shown.

LIST DATE(S) ALLEGED VIOLATION OCCURRED

How and why do you believe your (or someone else’s) health information privacy rights were violated, or how another violation of HIPAA occurred? Please be as specific as possible.

(Attach additional pages as needed)

^{HHS-700 (03/2019)} Page 1 of 2

If your complaint involves an individual request for health records, was the request made in writing?	Yes	No
Was the written request for health records made more than 60 days ago?	Yes	No
Was the written request to send the health records to someone other than the requestor?	Yes	No
Have you attempted to resolve this matter with the agency or organization against which you are filing?	Yes	No
If yes, please describe your efforts and provide copies of any relevant documents.

Do you have any witnesses? If yes, please provide name(s) and contact information.

WITNESS NAME(S)	E-MAIL ADDRESS	PHONE (Please include area code)

Please sign and date this complaint. You do not need to sign if submitting this form by email because submission by email represents your signature.

SIGNATURE	DATE (mm/dd/yyyy)

Filing a complaint with OCR is voluntary. However, without the information requested above, OCR may be unable to proceed with your complaint. We collect this information under authority of Section 1557 of the Affordable Care Act, Title VI of the Civil Rights Act of 1964, Section 504 of the Rehabilitation Act of 1973, Title IX of the Education Amendments of 1972, the Age Discrimination Act of 1975, Title II of the Americans with Disabilities Act and their implementing regulations. It is illegal for a recipient of Federal financial assistance from HHS to intimidate, threaten, coerce, discriminate or retaliate against you for filing a complaint or for taking any other action to enforce your rights under these Federal civil rights laws. OCR also collects information under authority of Section 1553 of the Affordable Care Act, the Church Amendments, the Coats-Snowe Amendment, the Weldon Amendment, as well as other Federal civil rights, conscience protections and religious liberty statutes. It may also be illegal for a recipient of Federal financial assistance from HHS to intimidate, threaten, coerce, discriminate or retaliate against you for filing this complaint or for taking any other action to enforce your rights under these Federal laws. We will use the information you provide to determine if we have jurisdiction and, if so, how we will process your complaint. Information submitted on this form is treated confidentially and is protected under the provisions of the Privacy Act of 1974. Names or other identifying information about individuals are disclosed when it is necessary for investigation of possible discrimination, for internal systems operations, or for routine uses, which include disclosure of information outside the Department of Health and Human Services (HHS) for purposes associated with civil rights compliance and as permitted by law. You are not required to use this form. You also may write a letter or submit a complaint electronically with the same information. To submit an electronic complaint, go to OCR’s web site at: www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html?language=es.To mail a complaint, please see page 2 of this form for the mailing address.

^{HHS-700 (03/2019)} Page 2 of 3

The remaining information on this form is optional. Failure to answer these voluntary questions will not affect OCR’s decision to process your complaint.

Fdsfhere

Do you need special accommodations for OCR to communicate with you about this complaint? (Check all that apply)

	Braille		Large Print				TDD		Other (Specify):
		ff Interpreter (specify language):

If we cannot reach you directly, is there someone we can contact to help us reach you?

YOUR FIRST NAME		YOUR LAST NAME
PHONE (Please include area code)
STREET ADDRESS				CITY
STATE	ZIP		E-MAIL ADDRESS

Have you filed your complaint anywhere else? If so, please provide the following.

NAME(S) OF AGENCY / ORGANIZATION / COURT
DATE(S) FILED	CASE NUMBER(S) (If known)

Has your complaint been accepted by the other agency/organization/court? Yes No

Has there been a decision or a determination? Yes No

If yes, please provide a copy of that decision or determination.

To help us better serve the public, please provide the following optional information for the person you believe was discriminated against

(you or the person on whose behalf you are filing).

ETHNICITY (select one) RACE (select one or more)

	Hispanic or Latino		American Indian or Alaska Native		Asian	Native Hawaiian or Other Pacific Islander
	Not Hispanic or Latino		Black or African American		White	Middle Eastern or North African
						Other (specify):
PRIMARY LANGUAGE SPOKEN (if other than English):

To submit a complaint, please type or print, sign, and return completed complaint form package (including consent form) to the OCR Headquarters address below.

U.S. Department of Health and Human Services

Office for Civil Rights Centralized

Case Management Operations

200 Independence Ave., S.W. Suite 515F, HHH Building

Washington, D.C. 20201

Customer Response Center: (800) 368-1019

Fax: (202) 619-3818

TDD: (800) 537-7697

Email: [email protected]

Burden Statement

Public reporting burden for the collection of information on this complaint form is estimated to average 45 minutes per response, including the time for reviewing instructions, gathering the data needed and entering and reviewing the information on the completed complaint form. An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to: HHS/OS Reports Clearance Officer, Office of Information Resources Management, 200 Independence Ave. S.W., Room 531H, Washington, D.C. 20201. Please do not mail complaint form to this address.

HHS-700 (03/2019) Page 3 of 3

CONSENT FORM

The Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) has the authority to collect and receive material and information about an individual, including personnel and medical records, when they are relevant to its investigation.

To investigate a complaint, OCR may need to disclose the individual’s name and other identifying information about the individual to persons at the entity or agency under investigation or to other persons, agencies, or entities. In some circumstances, OCR may refer a complaint to another government agency, as warranted.

The Privacy Act of 1974 protects certain federal records that contain personally identifiable information and, with your consent, allows OCR to use an individual’s name or other personal information, if necessary, to investigate a complaint.

Consent is voluntary, and it is not always needed in order to investigate a complaint; however, failure to give consent is likely to impede the investigation of a complaint and may result in the closure of the case.

Additionally, OCR may disclose information, including medical records and other personal information, which it has gathered during the course of its investigation in order to comply with a request under the Freedom of Information Act (FOIA) and may refer a complaint to another appropriate agency.

Under FOIA, OCR may be required to release information regarding the investigation of a complaint; however, we will make every effort, as permitted by law, to protect information that identifies individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy.

OCR will use any applicable protections in that law to safeguard information which could identify an individual, or that, if released, could constitute a clearly unwarranted invasion of personal privacy. OCR may be required to release some information regarding the investigation of a complaint under the Freedom of Information Act (FOIA).

Please read and review the documents entitled Notice to Complainants and Other Individuals Asked to Supply Information to the Office for Civil Rights ^and Protecting Personal Information in Complaint Investigations for further information regarding how OCR may obtain, use, and disclose your information while investigating your complaint.

In order to expedite the investigation of this complaint if it is accepted by OCR, please read, sign, and return one copy of this consent form to OCR with your complaint. Please make one copy for your records.

• I understand that in the course of the investigation of this complaint it may become necessary for OCR to reveal my identity or identifying information about me to persons at the entity or agency under investigation or to other persons, agencies, or entities.

• I am also aware of the obligations of OCR to honor requests under the Freedom of Information Act (FOIA). I understand that it may be necessary for OCR to disclose information which it has gathered as part of its investigation of this complaint.

• ^{In addition, I understand that I may be covered by the Department of} Health and Human Services’ (HHS) regulations which protect any individual from being intimidated, threatened, coerced, retaliated against, or discriminated against because the individual has made a complaint, testified, assisted, in any manner in any mediation, investigation, hearing, proceeding, or other part of HHS’s investigation, conciliation, or enforcement process.

After reading the above information, please check ONLY ONE of the following boxes:

CONSENT: I have read, understand, and agree to the above and give permission to OCR to reveal my identity or identifying information about me to persons at the entity or agency under investigation or to other relevant persons, agencies, or entities during any part of HHS’ investigation, conciliation, or enforcement process.

CONSENT DENIED: I have read and I understand the above and do not give permission to OCR to reveal my identity or identifying information about me. I understand that this denial of consent is likely to impede the investigation of this complaint and may result in closure of the investigation.

Signature: Date:

*Please sign and date this complaint. You do not need to sign if submitting this form by email because submission by email represents your signature.

Name (Please print): Address:

Telephone Number:

NOTICE TO COMPLAINANTS AND OTHER INDIVIDUALS ASKED TO SUPPLY INFORMATION TO THE OFFICE FOR CIVIL RIGHTS

Privacy Act

The Privacy Act of 1974 (5 U.S.C. §552a) requires OCR to notify individuals whom it asks to supply information that:

— OCR is authorized to solicit information under:

1. Federal laws barring discrimination by recipients of Federal financial assistance on grounds of race, color, national origin, disability, age, sex, religion under programs and activities receiving Federal financial assistance from the U.S. Department of Health and Human Services (HHS), including, but not limited to, Title VI of the Civil Rights Act of 1964 (42 U.S.C. §2000d et seq.), Section 504 of the Rehabilitation Act of 1973 (29

U.S.C. §794), the Age Discrimination Act of 1975 (42 U.S.C. §6101 et seq.), Title IX of the Education Amendments of 1972 (20 U.S.C. §1681 et seq.), Sections 794 and 855 of the Public Health Service Act (42 U.S.C. §§295m and 296g); and Section 1557 of the Affordable Care Act (42 U.S.C. §18116);

2. Federal laws protecting rights of conscience in health and human services programs, such as Sections 1303(b)(4) and 1553 of the Affordable Care Act (42 U.S.C. §§18113, 18023(b)(4)), the Church Amendments (42 U.S.C. § 300a-7), the Coats-Snowe Amendment (42 U.S.C §238n), and the Weldon Amendment (e.g., Departments of Labor, Health and Human Services, and Education, and Related Agencies Appropriations Act, 2022, Pub. L. No. 117-103, Div. H., Title V §507(d)), and applicable regulations;

3. Titles VI and XVI of the Public Health Service Act (42 U.S.C. §§291 et seq. and 300s et seq.) and 42 C.F.R. Part 124, Subpart G (Community Service obligations of Hill- Burton facilities);

4. 45 C.F.R. Part 85, as it implements Section 504 of the Rehabilitation Act in programs conducted by HHS; and

5. Title II of the Americans with Disabilities Act (42 U.S.C. §12131 et seq.) and Department of Justice regulations at 28 C.F.R. Part 35, which give HHS “designated agency” authority to investigate and resolve disability discrimination complaints against certain public entities, defined as health and service agencies of state and local governments, regardless of whether they receive federal financial assistance.

HIPAA Standards for the Privacy of Individually Identifiable Health Information (The Privacy Rule), 45 C.F.R. Part 160 and Subparts A and E of Part 164, Health Insurance Reform: Security Standards (The Security Rule), 45 C.F.R. Part 160 and Subparts A and C of Part 164, Breach Notification for Unsecured Protected Health Information (The Breach Rule), 45 C.F.R. Part 160 and Subparts A and D of Part 164, and Administrative Simplification: Enforcement, 45 C.F.R. Part 160, Subparts C, D, and E, which contains provisions relating to compliance and investigations, the imposition of civil money penalties, and procedures for hearings related to violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. §1320d-2).

OCR will request information for the purpose of determining and securing compliance with the Federal laws listed above. Disclosure of this requested information to OCR by individuals who are not recipients of federal financial assistance is voluntary; however, even individuals who voluntarily disclose information are subject to prosecution and penalties under 18 U.S.C. § 1001 for making false statements.

Additionally, although disclosure is voluntary for individuals who are not recipients of federal financial assistance, failure to provide OCR with requested information may preclude OCR from making a compliance determination or enforcing the laws above.

OCR has the authority to disclose personal information collected during an investigation without the individual’s consent for the following routine uses:

1. to make disclosures to OCR contractors who are required to maintain Privacy Act safeguards with respect to such records;

2. for disclosure to a congressional office from the record of an individual in response to an inquiry made at the request of the individual;

3. to make disclosures to the Department of Justice to permit effective defense of litigation; and

4. to make disclosures to the appropriate agency in the event that records maintained by OCR to carry out its functions indicate a violation or potential violation of law.

Under 5 U.S.C. §552a(k)(2) and the HHS Privacy Act regulations at 45 C.F.R. §5b.11 OCR complaint records have been exempted as investigatory material compiled for law enforcement purposes from certain Privacy Act access, amendment, correction and notification requirements.

Freedom of Information Act

A complainant, the recipient or any member of the public may request release of OCR records under the Freedom of Information Act (5 U.S.C. §552) (FOIA) and HHS regulations at 45 C.F.R. Part 5.

Fraud and False Statements

Federal law, at 18 U.S.C. §1001, authorizes prosecution and penalties of fine or imprisonment for conviction of “whoever, in any matter within the jurisdiction of any department or agency of the United States knowingly and willfully falsifies, conceals or covers up by any trick, scheme, or device a material fact, or makes any false, fictitious or fraudulent statements or representations or makes or uses any false writing or document knowing the same to contain any false, fictitious, or fraudulent statement or entry.”

PROTECTING PERSONAL INFORMATION IN COMPLAINT INVESTIGATIONS

To investigate a complaint, the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) will collect information from different sources. Depending on the type of complaint, we may need to get copies of medical records or other personal information. This Fact Sheet explains how OCR protects personal information that is part of an investigative case file.

HOW DOES OCR PROTECT PERSONAL INFORMATION?

OCR is required by law to protect personal information. The Privacy Act of 1974 protects Federal records about an individual containing personally identifiable information, including, but not limited to, the individual’s medical history, education, financial transactions, and criminal or employment history that contains an individual’s name or other identifying information.

Under the Privacy Act, OCR will disclose an individual’s name or other personal information with a signed consent, and only when it is necessary to complete the investigation of the complaint or to enforce civil rights laws or when it is otherwise permitted by law.

Consent is voluntary, and it is not always needed in order to investigate a complaint; however, failure to give consent is likely to impede the investigation of a complaint and may result in the closure of the case.

CAN THE COMPLAINANT SEE OCR’s CASE FILE?

Under the Freedom of Information Act (FOIA), an individual can request a copy of the individual’s case file once the case has been closed; however, OCR may, in some circumstances, withhold information in order to protect the identities of witnesses and other sources of information. Additionally, some records may be withheld to protect OCR’s deliberative process privilege or any other legally protected privilege.

CAN OCR GIVE A COMPLAINT FILE TO ANYONE ELSE?

If a complaint indicates a violation or a potential violation of law, OCR can refer the complaint to another appropriate agency without the individual’s permission.

If an individual files a complaint with OCR, and we decide we cannot help the individual, we may refer the complaint to another agency, such as the Department of Justice.

CAN ANYONE ELSE SEE THE INFORMATION IN A COMPLAINT FILE?

Public access to OCR’s files and records is controlled by the Freedom of Information Act (FOIA). Under FOIA, OCR may be required to release general information about this case upon public request. In the event that OCR receives such a request, we will make every effort, as permitted by law, to protect information that identifies individuals.

If OCR receives protected health information about an individual in connection with a HIPAA investigation or compliance review, we will only share this information with individuals outside of HHS if necessary for our compliance efforts or if we are required to do so by another law.

DOES IT COST ANYTHING FOR ME (OR SOMEONE ELSE) TO OBTAIN A COPY OF MY FILE?

In most cases, the first two hours spent searching for document(s) you request under the Freedom of Information Act and the first 100 pages are free. Additional search time or copying time may result in a cost for which you will be responsible. If you wish to limit the search time and number of pages to a maximum of two hours and 100 pages; please specify this in your request. You may also set a specific cost limit, for example, cost not to exceed $100.00. For details, see HHS’s FOIA page.

If you have any questions about this complaint and consent package, please contact OCR at www.hhs.gov/ocr/office/about/contactus/index.html.

OR

Contact the Customer Response Center at (800) 368-1019 (see contact information on page 2 of the Complaint Form).