HIPAA, PRIVACY & CONFIDENTIALITY NOTICE

Patient Rights, 42 CFR Part 2, and Complaint Information

Effective Date: September 21, 2026

Privacy Contact: Kia Jefferson | (470) 402-9409 | admin@holtshc.org

This unified packet consolidates the privacy, confidentiality, patient-rights, and complaint information provided in the source notices into one consistently formatted document.

HIPAA NOTICE OF PRIVACY PRACTICES

Your Information. Your Rights. Our Responsibilities.
This notice describes how medical information about you may be used and disclosed and how you can get access to this
information. Please review it carefully.

Your Rights
You have the right to:
• Get a copy of your paper or electronic medical record
• Correct your paper or electronic medical record
• Request confidential communication
• Ask us to limit the information we share
• Get a list of those with whom we’ve shared your information
• Get a copy of this privacy notice
• Choose someone to act for you
• File a complaint if you believe your privacy rights have been violated

Your Choices
You have some choices in the way that we use and share information as we:
• Tell family and friends about your condition
• Provide disaster relief
• Include you in a hospital directory
• Provide mental health care
• Market our services and sell your information
• Raise funds

Our Uses and Disclosures
We may use and share your information as we:
• Treat you
• Run our organization
• Bill for your services
• Help with public health and safety issues
• Do research
• Comply with the law
• Respond to organ and tissue donation requests
• Work with a medical examiner or funeral director
• Address workers’ compensation, law enforcement, and other government requests
• Respond to lawsuits and legal actions

To the extent that we have your substance use disorder patient records, subject to 42 CFR part 2, we will not share that information for investigations or legal proceedings against you without (1) your written consent or (2) a court order and a subpoena.

Your Rights
When it comes to your health information, you have certain rights. This section explains your rights and some of our
responsibilities to help you.
Get an electronic or paper copy of your medical record
• You can ask to see or get an electronic or paper copy of your medical record and other health information
we have about you. Ask us how to do this.
• We will provide a copy or a summary of your health information, usually within 30 days of your request. We
may charge a reasonable, cost-based fee.

Ask us to correct your medical record
• You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how
to do this.
• We may say “no” to your request, but we’ll tell you why in writing within 60 days.

Request confidential communications
• You can ask us to contact you in a specific way (for example, home, office, or cell phone) or to send mail to
a different address.
• We will say “yes” to all reasonable requests.

Ask us to limit what we use or share
• You can ask us not to use or share certain health information for treatment, payment, or our operations. We
are not required to agree to your request, and we may say “no,” for example, if it could affect your care. If we agree to your request, we may still share this information in the event that you need emergency treatment.
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information
for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

Get a list of those with whom we’ve shared information
• You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the
date you ask, who we shared it with, and why.
• We will include all the disclosures except for those about treatment, payment, and health care operations,
and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

Get a copy of this privacy notice
You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We
will provide you with a paper copy promptly.

Choose someone to act for you
• If someone has authority to act as your personal representative, such as if someone has your medical power
of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health
information.
• We will make sure the person has this authority and can act for you before we take any action.

File a complaint if you feel your rights are violated
• You can complain if you feel we have violated your rights by contacting us using the information on page 1.
• You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by
sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting
https://www.hhs.gov/hipaa/filing-a-complaint/index.html.
• We will not retaliate against you for filing a complaint.

Your Choices
For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow
your instructions. In these cases, you have both the right and choice to tell us to:
• Share information with your family, close friends, or others involved in your care or payment for your care
• Share information in a disaster relief situation
• Include your information in a hospital directory

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety. In these cases we never share your information unless you give us written permission:
• Marketing purposes
• Sale of your information
• Most sharing of psychotherapy notes
In the case of fundraising:
• We may contact you for fundraising efforts, but you can tell us not to contact you again.
If we have your substance use disorder patient records, subject to 42 CFR part 2, we will give you clear and obvious notice in advance and a choice about whether to receive fundraising communications that use your Part 2 information.

Our Uses and Disclosures

How do we typically use or share your health information?
We typically use or share your health information in the following ways.
Treat you
We can use your health information and share it with other professionals who are treating you. Example: A doctor treating you for an injury asks another doctor about your overall health condition.

Run our organization
We can use and share your health information to run our practice, improve your care, and contact you when necessary.
Example: We use health information about you to manage your treatment and services.

Bill for your services
We can use and share your health information to bill and get payment from health plans or other entities.
Example: We give information about you to your health insurance plan so it will pay for your services.

How else can we use or share your health information?
We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes.
In all cases, including those listed below, if we have substance use disorder patient records about you, subject to 42 CFR
part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena.

Help with public health and safety issues
We can share health information about you for certain situations such as:
• Preventing disease
• Helping with product recalls
• Reporting adverse reactions to medications
• Reporting suspected abuse, neglect, or domestic violence
• Preventing or reducing a serious threat to anyone’s health or safety

Do research
We can use or share your information for health research.

Comply with the law
We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

Respond to organ and tissue donation requests
We can share health information about you with organ procurement organizations.

Work with a medical examiner or funeral director
We can share health information with a coroner, medical examiner, or funeral director when an individual dies.

Address workers’ compensation, law enforcement, and other government requests
We can use or share health information about you:
• For workers’ compensation claims
• For law enforcement purposes or with a law enforcement official
• With health oversight agencies for activities authorized by law
• For special government functions such as military, national security, and presidential protective services

Respond to lawsuits and legal actions
• We can share health information about you in response to a court or administrative order, or in response to a
subpoena.

Our Responsibilities
• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of
your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described in this notice unless you tell us we can
in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
For more information see: https://www.hhs.gov/hipaa/for-individuals/notice-privacy-practices/index.html.

Changes to the Terms of this Notice
We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in our office, and on our web site.

Other Instructions for Notice
• Effective Date of this Notice : September 21, 2026
• Name or title of the privacy official (or other privacy contact) and his/her email address and phone number.

Kia Jefferson (470)402-9409 admin@holtshc.org
• We never market or sell personal information.
• We will not share your mental health treatment records without your written consent unless it is for treatment
or another law requires us to share the information.” Insert this type of information here. If no laws with greater limits apply to your entity, no information needs to be added.
• If your entity provides patients with access to their health information using an online portal, you may want to
insert a reference to it here.

Your Rights Under HIPAA
This guidance remains in effect only to the extent that it is consistent with the court’s order in Ciox Health, LLC v. Azar, No. 18-cv-0040 (D.D.C. January 23, 2020), which may be found at https://www.hhs.gov/hipaa/court-order-right-of- access/index.html. More information about the order is available at https://www.hhs.gov/hipaa/court-order-right-of- access/index.html. Any provision within this guidance that has been vacated by the Ciox Health decision is rescinded. Most of us believe that our medical and other health information is private and should be protected, and we want to know who has this information. The Privacy Rule, a Federal law, gives you rights over your health information and sets rules and limits on who can look at and receive your health information. The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral. The Security Rule is a Federal law that requires security for health information in electronic form.

HIPAA Right of Access Videos
OCR has teamed up with the HHS Office of the National Coordinator for Health IT to create Your Health Information, Your Rights!, a series of three short, educational videos (in English and option for Spanish captions) to help you understand
your right under HIPAA to access and receive a copy of your health information.
• Individual’s Right under HIPAA to Access their Health Information
• HIPAA Access Associated Fees and Timing
• HIPAA Access and Third Parties

HIPAA Right of Access Infographic
OCR has teamed up with the HHS Office of the National Coordinator for Health IT to create this one-page fact sheet, with
illustrations, that provides an overall summary of your rights under HIPAA:
• Your Health Information, Your Rights! [PDF, 5.04 MB]

HIPAA General Fact Sheets
• Your Health Information Privacy Rights [PDF, 456 KB]
• Privacy, Security, and Electronic Health Records [PDF, 469 KB]
• Sharing Health Information with Family Members and Friends [PDF, 537 KB]

Who Must Follow These Laws
We call the entities that must follow the HIPAA regulations "covered entities."
Covered entities include:
• Health Plans, including health insurance companies, HMOs, company health plans, and
certain government programs that pay for health care, such as Medicare and Medicaid.
• Most Health Care Providers—those that conduct certain business electronically, such
as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors,
nursing homes, pharmacies, and dentists.
• Health Care Clearinghouses—entities that process nonstandard health information
they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.
In addition, business associates of covered entities must follow parts of the HIPAA regulations.
Often, contractors, subcontractors, and other outside persons and companies that are not employees of a covered entity will need to have access to your health information when providing services to the covered entity. We call these entities “business associates.” Examples of business associates include:
• Companies that help your doctors get paid for providing health care, including billing
companies and companies that process your health care claims
• Companies that help administer health plans
• People like outside lawyers, accountants, and IT specialists
• Companies that store or destroy medical records
Covered entities must have contracts in place with their business associates, ensuring that they use and disclose your health information properly and safeguard it appropriately. Business associates must also have similar contracts with subcontractors. Business associates (including subcontractors) must follow the use and disclosure provisions of their contracts and the Privacy Rule, and the safeguard requirements of the Security Rule.

Who Is Not Required to Follow These Laws
Many organizations that have health information about you do not have to follow these laws.
Examples of organizations that do not have to follow the Privacy and Security Rules include:
• Life insurers
• Employers
• Workers compensation carriers
• Most schools and school districts
• Many state agencies like child protective service agencies
• Most law enforcement agencies
• Many municipal offices

What Information Is Protected
• Information your doctors, nurses, and other health care providers put in your medical
record
• Conversations your doctor has about your care or treatment with nurses and others
• Information about you in your health insurer’s computer system
• Billing information about you at your clinic
• Most other health information about you held by those who must follow these laws

How This Information Is Protected
• Covered entities must put in place safeguards to protect your health information and ensure they do not use or disclose your health information improperly.
• Covered entities must reasonably limit uses and disclosures to the minimum necessary
to accomplish their intended purpose.
• Covered entities must have procedures in place to limit who can view and access your
health information as well as implement training programs for employees about how to protect your health information.
• Business associates also must put in place safeguards to protect your health information
and ensure they do not use or disclose your health information improperly.

What Rights Does the Privacy Rule Give Me over My Health Information?
Health insurers and providers who are covered entities must comply with your right to:
• Ask to see and get a copy of your health records
• Have corrections added to your health information
• Receive a notice that tells you how your health information may be used and shared
• Decide if you want to give your permission before your health information can be used or
shared for certain purposes, such as for marketing
• Request that a covered entity restrict how it uses or discloses your health information
• Get a report on when and why your health information was shared for certain purposes
• If you believe your rights are being denied or your health information isn’t being
protected, you can
○ File a complaint with your provider or health insurer
○ File a complaint with HHS
You should get to know these important rights, which help you protect your health information.
You can ask your provider or health insurer questions about your rights.
Learn more about your health information privacy rights [PDF, 456 KB].

Who Can Look at and Receive Your Health Information
The Privacy Rule sets rules and limits on who can look at and receive your health information
To make sure that your health information is protected in a way that does not interfere with your health care, your information can be used and shared:
• For your treatment and care coordination
• To pay doctors and hospitals for your health care and to help run their businesses
• With your family, relatives, friends, or others you identify who are involved with your health care or your health care bills, unless you object
• To make sure doctors give good care and nursing homes are clean and safe
• To protect the public's health, such as by reporting when the flu is in your area
• To make required reports to the police, such as reporting gunshot wounds
Your health information cannot be used or shared without your written permission unless this law allows it. For example, without your authorization, your provider generally cannot:
• Give your information to your employer
• Use or share your information for marketing or advertising purposes or sell your
information

SUBSTANCE USE DISORDER PRIVACY NOTICE (42 CFR PART 2)
Your Information. Your Rights. Our Responsibilities.
Notice of Privacy Practices
This notice describes:
• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR
HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION
YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH
[ENTER NAME OR TITLE] AT [PHONE AND EMAIL] IF YOU HAVE ANY QUESTIONS. In this notice, your health
information means your substance use disorder patient record.

Your Rights
You have the right to:
• Consent to most uses and disclosures of your health information
• Ask us to limit the information we share
• Get a copy of this privacy notice
• Discuss this notice with someone in our program
• Get a list of those with whom we’ve shared your electronic records
• Get a list of health care providers who have received your information through certain third parties
• Choose in advance whether to receive fundraising communications
• File a complaint if you believe your privacy rights have been violated

Your Choices
With your consent, we can use and share your information as we:
• Treat you
• Run our organization
• Bill for our services
• Fulfill your requests to share information with your consent
• Prevent multiple program enrollments
• Report about court-referred treatment
• Report to prescription drug monitoring programs

Our Uses and Disclosures
We may use and share your information without your consent as we:
• Communicate within our program and with our contractors
• Help with medical emergencies
• Help with public health
• Report crimes (and threats of crimes) on our premises and suspected child abuse and neglect
• Aid scientific research
• Respond to audits and evaluations of our program
• Assist cause of death inquiries
• Respond to court orders
In all these circumstances, we must protect your information and limit how we use and share it.

Your Rights
When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.

Provide consent when we use or share your information for most purposes
• You may provide a single consent for all future uses or disclosures for treatment, payment, and health care
operations purposes.
• You may provide consent for more limited purposes (for example, to only disclose information to another health care provider for your treatment); however, doing so may affect the services we can provide you or how you pay for services.]
• You may provide a general consent to share your information through certain third parties, such as a health
information network or a research institution, where your treating health care providers can access it.]

Ask us to limit what we use or share
• You can ask us not to use or share certain health information for treatment, payment, or our health care
operations after you have provided consent for all those purposes. We are not required to agree to your request, and we may say “no” if, for example, it could affect your care. If we agree to your request, we may still share this information in the event that you need emergency treatment.
• If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information
for the purpose of payment or our health care operations with your health insurer. We will say “yes” unless a law require us to share that information.

Get a copy of this privacy notice
You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

Discuss this notice with someone in our program
You can ask questions or obtain more information about this notice and our privacy practices by calling or emailing the contact person at the top of this notice.

Choose in advance about fundraising
You have the right to a clear and obvious notice in advance of, and a choice about whether to receive, fundraising communications for our program.

File a complaint if you feel your rights are violated
• You can complain if you feel we have violated your rights by contacting us using the information on page 1.
• You can file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights by
sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting
https://www.hhs.gov/hipaa/filing-a-complaint/index.html.
• We will not retaliate against you for filing a complaint.

Your Choices

How do we typically use or share your health information?
With your consent, we typically use or share your health information in the following ways.
Treat you
We can use your health information and share it with other professionals who are treating you. Example: A doctor treating you for a chronic condition asks a doctor at our program about your health condition and medications you are taking, for example, to avoid complications.
Run our organization
We can use and share your health information to run our program, improve your care, and contact you when necessary.
Example: We use health information about you to manage your treatment and services.
Bill for your services
We can use and share your health information to bill and get payment from health plans or other entities. Example: We give information about you to your health insurance plan so it will pay for your services.
With your consent, we may also use and share your information in the following ways:
• To whomever you name in a consent to share your information
• To prevent multiple enrollments in withdrawal management or maintenance treatment programs
• To report participation in treatment required by the criminal justice system
• To report prescribed substance use disorder treatment medications to a state prescription drug monitoring
program when required by law
You can choose someone to act for you.
• If someone has authority to act as your personal representative, such as if someone has your medical power
of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
• We will make sure the person has this authority and can act for you before we take any action.

Our Uses and Disclosures

How else can we use or share your health information?
We are allowed or required to share your information in certain ways without your consent – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes.

To communicate within our program and with contractors
We can share your information within our program, with an organization that has administrative control over our program, and with contractors who help us run our program.

For medical emergencies
We can share your information during a bona fide medical emergency with the personnel and health care providers responding to your emergency, even when you are unable to consent because of the emergency. We can also share your identifying information to assist the federal Food and Drug Administration in notifying you or your doctor about unsafe products you may be using.

Help with public health
We can share health information that does not identify you for certain situations such as:
• Preventing disease
• Reporting adverse reactions to medications

Aid scientific research
We can use or share your information to conduct or help with health research. Researchers cannot include any patient identifying information in their reports about the research.

Respond to management and financial audits and program evaluations
We can use or share your information to improve the quality of our services, obtain needed credentials, and cooperate with oversight agencies for activities authorized by law, as long as those who view or receive the information agree to destroy or return the information when they are finished and agree not to use it against you.

Assist with cause of death inquiries
We can share patient identifying information about a deceased patient as required or allowed by laws that collect information relating to cause of death.

Report suspected child abuse and neglect
We will only report the information required by law.

Prevent or reduce crime in our program
We may report to law enforcement when a patient commits or threatens to commit a crime within our program or against our staff.

Redisclosure According to HIPAA
When you consent to uses and disclosures for all future treatment and payment purposes and to run our business, we may share your information with other substance use disorder treatment programs, doctors’ offices, and health care businesses for those activities. If the person who receives it is subject to HIPAA, then they are allowed to use and share your information again without your consent for the purposes that HIPAA allows. Your information still cannot be used in legal proceedings against you unless (1) you consent or (2) based on a Part 2 court order and a subpoena (or similar legal requirement).

Legal Proceedings and Court Orders
We must follow certain procedures before using or sharing your information for investigations and legal proceedings.
• We will not use or share your information or provide testimony about your information in any civil,
administrative, criminal, or legislative proceedings against you without your written consent or a court order.
• We will only respond to a court order to use or share your health information if it is accompanied by a
subpoena or other similar legal mandate requiring us to comply.
• We will only use or share your information in proceedings against you based on a court order after we have
received notice and an opportunity to be heard or you tell us that you have received notice.
• We may use or share your information to respond to legal proceedings against our program based on a
court order and you may not be notified in advance. You have the right to seek to overturn or change the court order after you learn about it.

Our Responsibilities
• We are required to obtain your consent for most uses and sharing of your information.
• We are required by law to maintain the privacy and security of your information.
• We must let you know promptly if a breach occurs that may have compromised the privacy or security of
your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described in this notice unless you tell us we can
in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

Changes to the Terms of this Notice
We are required to follow the terms of this notice that are currently in effect. We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request in our office and on our web site.

Effective Date

This notice is effective as of September 21, 2026

Other Instructions for Notice
• Kia Jefferson email: admin@holtshc.org Phone (470)402-9409
• We will provide you with a summary of your treatment history upon request.
“The information we can share about you for treatment is limited to admission forms, treatment/discharge forms, and discharge summaries.” Insert this type of information here. If no laws with greater limits apply to your entity, no information needs to be added.

OCR COMPLAINT & PATIENT SAFETY CONFIDENTIALITY INFORMATION

How to File a Patient Safety Confidentiality
Complaint

About Patient Safety Confidentiality

OCR enforces the confidentiality provisions of the Patient Safety and Quality Improvement Act of 2005 (Patient Safety Act) and the Patient Safety and Quality Improvement Rule (Patient Safety Rule). Together, the Patient Safety Act and Rule establish a voluntary system for Patient Safety Organizations (PSOs) to collect and analyze medical error and patient safety event data. To encourage provider reporting, the Patient Safety Act and Rule include Federal privilege and confidentiality protections for patient safety work products (PSWP). Information submitted to, and developed by, these PSOs is protected as PSWP.

What is PSWP?
PSWP is any information:
• Assembled or developed by a health care provider for reporting to a Patient Safety
Organization (PSO) that is listed by the HHS Agency for Healthcare Research and Quality (AHRQ) and is documented as
being within the provider’s patient safety evaluation system for reporting to a PSO
• Developed by a PSO for the conduct of patient safety activities
• Identifies or constitutes the deliberations, or analysis of, or identifies the fact of reporting pursuant to a patient safety evaluation system
PSWP may identify patients, health care providers and individuals that report medical errors or other patient safety events. This PSWP is confidential and may only be disclosed in certain very limited situations.

Complaint Requirements
Anyone can file a patient safety confidentiality complaint. If you believe that a person or organization shared PSWP, you
may file a complaint with OCR. Your complaint must:
• Be filed in writing: sent by mail, fax or e-mail
• Name the person that is the subject of the complaint and describe the act or acts believed to be in violation of the Patient Safety Act requirement to keep PSWP confidential
• Be filed within 180 days of when you knew or should have known that the act
complained of occurred, however OCR may waive the 180-day time limit for “good cause" shown

File a Patient Safety Confidentiality Complaint
File a Complaint Using the Patient Safety Confidentiality Complaint Form Package

Open and fill out the Patient Safety Confidentiality Complaint Form [PDF, 298 KB] and Consent Form Package [PDF, 272
KB] in PDF format. You will need Adobe Reader software to fill out the complaint and consent forms. You may either:
• Print and mail or fax the completed complaint and consent forms to the appropriate OCR
regional office
• Email the completed complaint and consent forms to OCRComplaint@hhs.gov (Please note that communication by unencrypted email presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties)

File a Complaint Without Using Our Patient Safety Confidentiality Complaint Package

If you prefer, you may submit a written complaint in your own format by either:
• Mail or fax to the appropriate OCR regional office
• Email to OCRComplaint@hhs.gov
Be sure to include:
• Your name
• Full address
• Telephone numbers (include area code)
• E-mail address (if available)
• Name, full address and telephone number of the person, agency, or organization you
believe violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy or Security Rule
• Brief description of what happened, including how, why, and when you believe a person
impermissibly disclosed patient safety work product
• Any other relevant information
• Your signature and date of complaint
You may also include:
• If you need special accommodations for us to communicate with you about this
complaint
• Contact information for someone who can help us reach you if we cannot reach you
directly
• If you have filed your complaint somewhere else and where you’ve filed

How OCR Investigates Your Complaint
OCR will investigate complaints that allege potential violations of the Rule. To the extent practicable, OCR will provide technical assistance and seek informal resolution of complaints involving the inappropriate sharing of PSWP through voluntary compliance from the responsible person, entity, or organization. When OCR is unable to achieve an informal resolution of an indicated violation through such voluntary compliance, the Secretary may impose a civil money penalty of up to $14,960 for each knowing and reckless disclosure of PSWP that is in violation of the confidentiality provisions.

HIPAA FAQs for Individuals
What does the HIPAA Privacy Rule do?
Does the HIPAA Privacy Rule expand the ability of providers, plans, marketers and others to use my protected health information to market goods and services to me? Does the Privacy Rule make it easier for health care businesses to engage in door-to-door sales and marketing efforts?
Can telemarketers obtain my health information and use it to call me to sell good and services?
How does the HIPAA Privacy Rule affect my rights under the Federal Privacy Act?
If I believe that my privacy rights have been violated, when can I submit a complaint?
If I do not object, can my health care provider share or discuss my health information with my family, friends, or others involved in my care or payment for my care?
If I am unconscious or not around, can my health care provider still share or discuss my health information with my family,
friends, or others involved in my care or payment for my care?
If my family or friends call my health care provider to ask about my condition, will they have to give my provider proof of who they are?
Can I have another person pick up my prescription drugs, medical supplies, or x-rays?
Can my health care provider discuss my health information with an interpreter?
Since the HIPAA Privacy Rule protects a decedent’s health information only for 50 years following the individual’s death, does my family health history recorded in my medical record lose protection when it involves family members who have
been deceased for more than 50 years?
Does the HIPAA Privacy Rule require my doctor to send my medical records to the government?
Will this HIPAA Privacy Rule make it easier for police and law enforcement agencies to get my medical information?
Under HIPAA, may an individual request that a covered entity restrict how it uses or discloses that individual’s protected
health information (PHI)?

Filing a Health Information Privacy

Complaint
You may file a complaint with the Office for Civil Rights (OCR) if you believe:
• A HIPAA covered entity or its business associate violated your (or someone
else’s) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification
Rules.
• A substance use disorder (SUD) treatment program violated your confidentiality
rights under 42 CFR part 2 (called “Part 2”).
OCR can investigate health information privacy complaints against covered entities (health plans, health care
clearinghouses, or health care providers that conduct certain transactions electronically) and their business associates. OCR can also investigate complaints of Part 2 violations against a Part 2 program or its qualified service organization; a lawful holder of Part 2 records, such as a HIPAA covered entity or its business associate; or another person holding Part 2 records.

Complaint Process
Anyone can file a complaint if they believe there has been a violation of the HIPAA Rules or Part 2. Learn what you'll need to submit your complaint online or in writing.
learn more

File a Complaint Online
File your HIPAA or Part 2 complaint electronically via the OCR Complaint Portal.
learn more

Filing a Patient Safety Confidentiality Complaint
Read about the Patient Safety Confidentiality Act and Rule and how to file a complaint online or in writing.
learn more

What to Expect
Learn how OCR investigates your complaint and what happens after the investigation is complete.
learn more

How to File a Health Information Privacy
or Security Complaint

Complaint Requirements
Anyone can file a complaint about noncompliance with the Health Insurance Portability and Accountability Act of 1996
(HIPAA) Privacy, Security, and Breach Notification Rules or 42 CFR part 2 (“Part 2”), Confidentiality of Substance Use
Disorder Patient Records.
Your complaint must:
• Be filed in writing by mail, fax, e-mail, or via the OCR Complaint Portal.
• Name the entity involved:
○ For a HIPAA complaint, name the covered entity or business associate ○ For a Part 2 complaint, name the Part 2 program, Qualified Service Organization, lawful holder of Part 2 records, or other person holding Part 2 records
• Describe the acts or omissions you believed violated the requirements of the Privacy,
Security, or Breach Notification Rules or Part 2.
• Be filed within 180 days of when you knew that the act or omission complained of
occurred. OCR may extend the 180- day period if you can show "good cause"

HIPAA and Part 2 Prohibit Retaliation
Under HIPAA and Part 2, an entity cannot retaliate against you for filing a complaint. You should notify OCR immediately in the event of any retaliatory action.

File a Health Information Privacy or Security Complaint
Online
Open the OCR Complaint Portal and select the type of complaint you would like to file. Complete as much information as
possible, including:
• Information about you, the complainant
• Details of the complaint
• Any additional information that might help OCR when reviewing your complaint
You will then need to electronically sign the complaint and complete the consent form. After completing the consent form, you will be able to print out a copy of your complaint to keep for your records

File a Health Information Privacy or Security Complaint in
Writing
File a Complaint Using the HIPAA Privacy and Security Complaint Form Package or the
Part 2 Complaint Form Package

Open and fill out the HIPAA Privacy and Security Complaint Form Package [PDF, 408 KB] or the Part 2 Complaint Form Package [PDF, 617 KB] in PDF format. You will need Adobe Reader software to fill out the complaint and consent forms.
You may either:
• Print and mail the completed complaint and consent forms to:

Centralized Case Management Operations

U.S. Department of Health and Human Services
200 Independence Avenue, S.W.

Room 509F HHH Bldg.
Washington, D.C. 20201
• Email the completed complaint and consent forms to OCRComplaint@hhs.gov (Please
note that communication by unencrypted email presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties)

File A Complaint Without Using Our Health Information Privacy Complaint Package
If you prefer, you may submit a written complaint in your own format by either:
• Print and mail the completed complaint and consent forms to:
Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201
• Email to OCRComplaint@hhs.gov
Be sure to include:
• Your name
• Full address
• Telephone numbers (include area code)
• E-mail address (if available)
• Name, full address and telephone number of the person, agency, or organization you
believe violated your (or someone else’s) health information privacy rights or committed another violation of the HIPAA Privacy, Security, or Breach Notification Rules or Part 2.
• Brief description of what happened. How, why, and when do you believe your (or
someone else’s) health information privacy rights were violated, or how the Privacy, Security, or Breach Notification Rules or Part 2 were otherwise violated
• Any other relevant information
• Your signature and date of complaint
If you are filing a complaint on someone’s behalf, also provide the name of the person on whose behalf you are filing.
You may also include:
• If you need special accommodations for us to communicate with you about this
complaint
• Contact information for someone who can help us reach you if we cannot reach you
directly
• If you have filed your complaint somewhere else and where you’ve filed

Before You File a HIPAA Complaint
Review these questions before filing a HIPAA complaint with OCR.
Are you filing a complaint against an entity that is required by law to comply with the HIPAA Privacy, Security, or Breach Notification Rules?
Not all entities are required to comply with the Privacy and Security Rules. OCR can only investigate the covered entities that must comply with these rules. Covered entities include most:
• Doctors
• Clinics
• Hospitals
• Psychologists
• Chiropractors
• Nursing Homes
• Pharmacies
• Dentists
• Health Insurance Companies
• Company Health Plans
• Medicare, Medicaid, and other government programs that pay for health care

Does your complaint describe an activity that might violate the Privacy or Security Rule?
If you are not sure, go ahead and file your complaint. But, OCR can only investigate complaints that allege an action or omission that fails to comply with the Privacy, Security, or Breach Notification Rules. For example, a doctor can send your medical test results to another doctor without your permission if the doctor needs the information to treat you; this is not a violation of the Privacy Rule, so we would not investigate a complaint that described this situation.
Are you willing to give OCR your name and contact information?
OCR does not investigate complaints filed without a name and contact information on the complaint. If you want OCR to keep your name and contact information confidential during the investigation, you may specify that on the consent form.