You do not need conclusive proof to file a health data privacy claim form. You need your name and contact information, the entity's name and contact details, and a description of the acts or omissions you believe violated the rules. A HIPAA complaint is a written report to the HHS Secretary about a covered entity or business associate. Federal regulation permits any person who believes a violation occurred to file on paper or electronically, according to the Cornell Law School Legal Information Institute reproducing the text of 45 CFR 160.306.
Official resources:
- Read the original report from FTC — Use this primary source to review the complete report.
- Read the original report from Unt — Use this primary source to review the complete report.
Table of Contents
- What information must you list?
- Do you need documents to file?
- What if medical identity theft is involved?
- When must you act?
What information must you list?
Name the person or entity involved and describe what happened. Include how, why, and when the incident occurred. HHS instructs filers to provide their name and contact information plus the entity's full address and phone number, according to the guidance on the HHS complaint process page.
The same regulation requires the complaint to identify the subject and describe the acts or omissions at issue. File by mail, fax, email, or the OCR Complaint Portal. HHS asks filers to complete as much information as possible so staff can assess jurisdiction and next steps.
Do you need documents to file?
You can file without attaching full evidence. The core filing is identification, contact details for both sides, and a brief factual account.
Supporting records still strengthen review. They help show who you are, what was lost, and how the event connects to the entity. Keep originals together for later requests:.
- breach notice and related letters from the provider or plan
- Explanation of Benefits forms, receipts, and account statements
- any FTC report or police report tied to the incident
What if medical identity theft is involved?
Check your Explanation of Benefits statements for provider, date, and service match. Look for bills for care you did not receive, unknown collections, or notices that benefit limits are reached. The FTC advises those three checks plus reviewing credit reports and requesting medical records, according to the archived FTC medical identity theft guidance.
Those records help spot misuse tied to your health information. Reporting at IdentityTheft.gov produces an FTC Identity Theft Report and personal recovery plan based on the information you enter. The site also provides prefilled letters for businesses, credit bureaus, and collectors.
When must you act?
File within 180 days of when you knew or should have known of the act or omission. HHS can waive that limit only for good cause shown.
Save proof of timing from the start. Keep the dated breach notice, EOBs, receipts, statements, and any FTC or police report in one folder. Use those dates to explain why your filing meets the deadline or why HHS should allow more time.