How to Fill Out and Submit the HHS HIPAA Complaint Form

To file a HIPAA complaint, submit form HHS-700 to the U.S. Department of Health and Human Services Office for Civil Rights within 180 days of learning about the violation. You can file online through the OCR Complaint Portal at ocrportal.hhs.gov, or send a signed paper form by mail, email, or fax. There is no filing fee, and you can file for yourself or on behalf of someone else.¹

Who You Can File Against

OCR only investigates complaints against a “covered entity” or its “business associate.” Covered entities are health plans, healthcare clearinghouses, and healthcare providers that transmit information electronically in connection with standard transactions.² Business associates are outside companies that handle protected health information for a covered entity, such as billing services, cloud storage vendors, or claims processors.³

Your complaint must describe conduct that would violate the HIPAA Privacy Rule, Security Rule, or Breach Notification Rule: sharing your health information without authorization, failing to protect electronic records from unauthorized access, or not notifying you after a breach. If the organization is not covered by HIPAA at all, such as an employer that learned about a condition through workplace gossip rather than from a healthcare provider, OCR has no jurisdiction and will not investigate.

You do not need to be the patient whose information was exposed. A parent, legal guardian, or anyone who witnessed a potential violation can file.¹

The 180-Day Deadline

The complaint must be filed within 180 days of when you knew or reasonably should have known about the violation.⁴ The clock runs from discovery, not from the underlying event. OCR can waive the deadline for good cause, but you have to ask for the waiver and explain why you could not file sooner. Treat the 180-day mark as firm.

What to Gather Before You Start

Having your materials organized before you open the form prevents the vague, incomplete submissions that OCR closes without investigating. Pull the following together:

The entity’s correct legal name and address. Check medical bills, explanation-of-benefits statements, or the provider’s website. Note the specific clinic location or department if that matters.
A timeline. When the incident occurred, when you discovered it, and what happened in between. Specific dates carry more weight than general timeframes.
Names and roles of any staff members you interacted with.
The type of information exposed: diagnosis codes, prescription records, Social Security numbers, treatment history, or another category. Specificity helps OCR gauge severity.
Supporting documents. Copies of emails, unauthorized mailings, screenshots of improperly disclosed records, breach notification letters, or receipts showing when a notification arrived.

Send copies. Keep your originals.

Filling Out the Form

Whether you use the online portal or the paper HHS-700, the form has four parts.⁵

Your Information

Full name, mailing address, phone number with area code, and email if you have one.⁶ If you are filing for someone else, add that person’s identifying information. OCR uses these details to reach you with follow-up questions and status updates.

Entity Information

Use the organization’s legal name, not a nickname or abbreviation. The name printed on your insurance card, medical bill, or patient portal is usually correct. Include the street address, phone number, and the department involved. A mistake here can delay the case or send the complaint to the wrong organization.

The Narrative

Describe what happened in chronological order. The regulation asks you to describe the acts or omissions you believe violated HIPAA.⁴ Stick to what happened, when, who was involved, and what information was affected. Skip theories about the entity’s motives. Two clear factual paragraphs beat a long emotional account that buries the key details.

Consent and Signature

The consent section controls whether OCR can share your identity with the entity being investigated. Allowing OCR to share your name makes the investigation easier, because the entity can pull your records and respond to specifics. Withholding it is an option, but if the investigator cannot point the entity to a particular file, the entity may not be able to respond meaningfully at all.

On the paper form, sign and date the complaint and the consent form before mailing. Email submissions do not require a handwritten signature; sending the form by email counts as your signature.⁶ The online portal walks you through an electronic signature before you submit.

How to Submit

Online. Go to ocrportal.hhs.gov, pick the type of complaint, complete each section, sign electronically, and finish the consent form. You get a confirmation number to track the complaint. The portal is available in 15 languages, including Spanish, Chinese, Arabic, Korean, Vietnamese, and Tagalog.⁷⁸
Mail. Send the signed paper form to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201.⁶
Email. Send the completed form to OCRComplaint@hhs.gov. No handwritten signature required.⁶
Fax. Send the signed form to (202) 619-3818.

The online portal is the fastest option and gives you an immediate confirmation number. If you mail a paper form, use a service with tracking so you have proof of delivery.

What Happens After You File

OCR reviews every complaint but does not investigate every one. During intake, staff check whether the complaint falls within OCR’s jurisdiction, whether it arrived within the 180-day window, and whether it describes conduct that would actually violate HIPAA.⁹ You will get a notification about whether the complaint moves forward or closes.

From there, OCR may provide technical assistance to the entity so it fixes the problem voluntarily, refer the matter to another agency, or open a formal investigation. Most complaints resolve at intake or through technical assistance. In 2021, OCR resolved more than 26,000 complaints, but only about 2,100 progressed to a full investigation.¹⁰

When an investigation confirms a violation, OCR typically pursues a resolution agreement in which the entity agrees to fix the problem, put corrective measures in place, and report to HHS for a monitoring period that generally runs three years.¹¹ If the entity refuses to cooperate or the violation is severe, OCR can impose civil money penalties. Investigations often take years.

The most common reasons complaints get closed are filing against an entity not covered by HIPAA, missing the 180-day deadline without asking for a waiver, and failing to describe specific conduct that would violate the Privacy, Security, or Breach Notification rules.⁸ Complaints too vague for OCR to identify the entity or the violation also get closed. Careful preparation is what carries a complaint through screening.

Protection From Retaliation

Federal regulations prohibit covered entities and business associates from retaliating against anyone who files a HIPAA complaint. Under 45 CFR § 160.316, an entity cannot threaten, intimidate, harass, or discriminate against you for filing, participating in an investigation, or opposing a practice you reasonably believe violates HIPAA.¹² The protection covers employees who report their own employer. If you experience retaliation after filing, report it to OCR as a separate complaint; the retaliation is itself a HIPAA violation.

What Filing Will and Won’t Do for You

An OCR complaint can lead to penalties against the entity and required corrective action, but it will not put money in your pocket. HIPAA has no private right of action, so you cannot sue a provider in federal court for the HIPAA violation itself, and any civil penalties OCR imposes go to the government rather than to you.

There are other paths worth knowing about. Under the HITECH Act, state attorneys general can bring civil actions against entities that violate HIPAA’s Privacy and Security Rules on behalf of state residents, seeking damages or injunctive relief.¹³ Filing with both OCR and your state AG raises the odds that someone acts, especially if the violation looks widespread. Many states also have their own medical privacy or consumer protection laws that do allow personal lawsuits over unauthorized disclosure of health information. If your goal is personal compensation, talk to an attorney about state-law claims in addition to filing the OCR complaint.

1
HHS.gov. Filing a Health Information Privacy Complaint
2
HHS.gov. Covered Entities and Business Associates
3
HHS.gov. Business Associates
4
eCFR. 45 CFR 160.306 – Complaints to the Secretary
5
HHS.gov. Health Information Privacy Complaint Form
6
HHS.gov. Complaint Process
7
HHS.gov. How to File a Health Information Privacy or Security Complaint
8
U.S. Department of Health & Human Services. OCR Complaint Portal
9
HHS.gov. What OCR Considers During Intake and Review of a Complaint
10
HHS.gov. Enforcement Results by Year
11
HHS.gov. Resolution Agreements
12
eCFR. 45 CFR 160.316 – Refraining From Intimidation or Retaliation
13
HHS.gov. State Attorneys General