02/20/2026
What to do if you suspect an unauthorized person has been looking into your medical records:
I can speak from experience on this. Not only has it happened to me, and the coworker lost her job, but I'm suspecting it happening now....in Illinois and I've started the process to have it investigated and demand whoever accessed it get fired, lose their licensing.
So this is a big deal, and health care organizations take this very seriously. Sometimes they even pursue civil or criminal action against the employee if the offense is bad enough. At the minimum the employee can expect to get fired if it’s someone without a license. If it’s someone with a license the offender can expect to speak to their licensing board about it.
The organization won’t discuss the matter with you freely. It’s going to take time to pull the audit trail and talk to those involved to make sure the access of your records was not authorized. There’s legal exposure they want to manage internally because They had a records breach, and they had to take disciplinary action against an employee.
If you are really that nosey, contact the patient advocate and if that fails, pay money to a lawyer and get a subpoena. You are going to need a legal remedy in mind to be made whole. Did this breach cost you a job or something?
You may file a complaint with the Office for Civil Rights (OCR) if you believe: A HIPAA covered entity or its business associate violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification Rules. A substance use disorder (SUD) treatment program violated your confidentiality rights under 42 CFR part 2 (called “Part 2”).OCR can investigate health information privacy complaints against covered entities (health plans, health care clearinghouses, or health care providers that conduct certain transactions electronically) and their business associates. OCR can also investigate complaints of Part 2 violations against a Part 2 program or its qualified service organization; a lawful holder of Part 2 records, such as a HIPAA covered entity or its business associate; or another person holding Part 2 records.
How to File a Health Information Privacy or Security Complaint:
Complaint Requirements Anyone can file a complaint about noncompliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach of records. Describe the acts or omissions you believed violated the requirements of the Privacy, Security, or Breach Notification Rules or Part 2.Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180- day period if you can show "good cause "HIPAA and Part 2 Prohibit Retaliation Under HIPAA and Part 2, an entity cannot retaliate against you for filing a complaint. You should notify OCR immediately in the event of any retaliatory action. File a Health Information Privacy or Security Complaint Online. Open the OCR Complaint Portal and select the type of complaint you would like to file. Complete as much information as possible, including: Information about you, the complainant: Details of the complaint: Any additional information that might help OCR when reviewing your complaint. You will then need to electronically sign the complaint and complete the consent form. After completing the consent form, you will be able to print out a copy of your complaint to keep for your records. File a Health Information Privacy or Security Complaint in Writing. File a Complaint Using the HIPAA Privacy and Security Complaint Form Package or the Part 2 Complaint Form Package. Open and fill out the HIPAA Privacy and Security Complaint Form Package [PDF, 1.01 MB] or the Part 2 Complaint Form Package [PDF, 617 KB] in PDF format. You will need Adobe Reader software to fill out the complaint and consent forms. You may either: Print and mail the completed complaint and consent forms to: Centralized Case Management Operations. Department of Health and Human Services200 Independence Avenue, S.W. Room 509F HHH Bldg. Washington, D.C. 20201Email the completed complaint and consent forms to [email protected] (Please note that communication by unencrypted email presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties)
File A Complaint Without Using Our Health Information Privacy Complaint Package If you prefer, you may submit a written complaint in your own format by either: Print and mail the completed complaint and consent forms to: Centralized Case Management Operations U.S. Department of Health and Human Services200 Independence Avenue, S.W.Room 509F HHH Bldg. Washington, D.C. 20201Email to OCR [email protected] Be sure to include: Your name Full address Telephone numbers (include area code)E-mail address (if available)Name, full address and telephone number of the person, agency, or organization you believe violated your (or someone else’s) health information privacy rights or committed another violation of the HIPAA Privacy, Security, or Breach Notification Rules or Part 2.Brief description of what happened. How, why, and when do you believe your (or someone else’s) health information privacy rights were violated, or how the Privacy, Security, or Breach Notification Rules or Part 2 were otherwise violated.Any other relevant informationYour signature and date of complaintIf you are filing a complaint on someone’s behalf, also provide the name of the person on whose behalf you are filing. You may also include:If you need special accommodations for us to communicate with you about this complaintContact information for someone who can help us reach you if we cannot reach you directlyIf you have filed your complaint somewhere else and where you’ve filedBefore You File a HIPAA ComplaintReview these questions before filing a HIPAA complaint with OCR.Are you filing a complaint against an entity that is required by law to comply with the HIPAA Privacy, Security, or Breach Notification Rules?Not all entities are required to comply with the Privacy and Security Rules. OCR can only investigate the covered entities that must comply with these rules. Covered entities include most: Doctors Clinics Hospitals Psychologists Chiropractors Nursing Homes Pharmacies Dentists Health Insurance Companies Company Health Plans Medicare, Medicaid, and other government programs that pay for health care. Does your complaint describe an activity that might violate the Privacy or Security Rule? If you are not sure, go ahead and file your complaint. But, OCR can only investigate complaints that allege an action or omission that fails to comply with the Privacy, Security, or Breach Notification Rules. For example, a doctor can send your medical test results to another doctor without your permission if the doctor needs the information to treat you; this is not a violation of the Privacy Rule, so we would not investigate a complaint that described this situation. Are you willing to give OCR your name and contact information? OCR does not investigate complaints filed without a name and contact information on the complaint. If you want OCR to keep your name and contact information confidential during the investigation, you may specify that on the consent form.