Get certified in HIPAA for Leaders for just $49.95.
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video
So, what do you do if you receive a HIPAA complaint? If you receive a complaint from a patient or a business about how you handled PHI, you must first note it in your incident log. You must also provide a complaint form for the patient or business to complete and explain the complaint in their own words, and note the date you received it. The privacy officer then conducts a formal investigation to determine whether any policies or procedures were not followed, and whether PHI may have been compromised. From there, one of two things happens. If the investigation finds no breach occurred, document your findings & how the complaint was resolved, and then close it out in your records. If the investigation finds that PHI was breached, follow your organization's breach response process, which are the same steps we covered earlier: determine whether it is a reportable breach, notify the affected individuals and HHS within the required timelines, and document each step. Whatever the outcome, two things matter. Document the complaint, your investigation, and the resolution, and keep those records as part of your Book of Evidence. Lastly, as a leader, you should never retaliate against someone for filing a complaint in good faith, because retaliation is itself a HIPAA violation.
Receiving a HIPAA complaint from a patient or business requires immediate, deliberate action. As an organizational leader, you must follow a structured response process, ensure thorough documentation, and maintain strict anti-retaliation standards to keep your compliance defensible.
When a complaint regarding the handling of Protected Health Information (PHI) is received, follow these operational steps immediately:
Depending on the Privacy Officer's findings during the investigation, proceed with one of two response paths:
Pro Tip: Build Your Book of Evidence: Document the original complaint, your investigation steps, and the final resolution regardless of the outcome. Keep all associated files filed safely inside your Book of Evidence.
Leaders must never retaliate against an individual or business for filing a HIPAA complaint in good faith. Retaliation itself is a direct HIPAA violation and subjects your organization to serious regulatory penalties.