On this page
The HIPAA complaint process has two parts: a covered entity must give people a way to complain about its privacy policies and compliance, with a named contact person or office to receive those complaints (45 CFR 164.530), and anyone can also file a written complaint with HHS's Office for Civil Rights (OCR), generally within 180 days (45 CFR 160.306). Covered entities must document every complaint and its outcome, keep those records for six years, and never retaliate against the person who complained. Curve Compliance, which helps healthcare marketers keep protected health information (PHI) out of ad platforms, checked each rule on eCFR and HHS on November 2, 2026.
Book a call. Worried a patient could complain about your website's tracking? Curve's team reviews what your site sends to Meta, Google and TikTok with you, then sets up server-side conversions that strip PHI before data reaches an ad platform. Book a call with Curve.
What the rule requires
HHS's summary puts the core in two sentences: a covered entity “must have procedures for individuals to complain about its compliance with its privacy policies and procedures and the Privacy Rule,” and it “must explain those procedures in its privacy practices notice” (HHS). Element by element, a complaint process contains:
| Element | What it means | Rule |
|---|---|---|
| A complaint process | A way for individuals to complain about the practice's privacy policies and procedures, or its compliance with them or the rule | 164.530(d)(1) |
| A named contact | A contact person or office responsible for receiving complaints, who can also answer questions about the notice of privacy practices | 164.530(a)(1)(ii) |
| A privacy official | The person responsible for developing and implementing the privacy policies and procedures | 164.530(a)(1)(i) |
| Written designations | A record of who holds both roles | 164.530(a)(2) |
| How to complain, in the notice | A statement that individuals may complain to the covered entity and to HHS, a brief description of how to complain to the covered entity, and a statement that no one will be retaliated against for filing | 164.520(b)(1)(vi) |
| Contact details, in the notice | The name or title and telephone number of the person or office to contact | 164.520(b)(1)(vii) |
| A record of every complaint | All complaints received and their disposition, if any | 164.530(d)(2) |
| Six-year retention | Keep that documentation for six years from creation or from when it was last in effect, whichever is later | 164.530(j)(2) |
| No retaliation | No intimidation, threats, coercion, discrimination or other retaliation against anyone for filing a complaint | 164.530(g); 45 CFR 160.316 |
| No waivers | Patients cannot be required to waive their right to complain to HHS as a condition of treatment, payment, enrollment or eligibility for benefits | 164.530(h) |
The rule does not prescribe a form, a channel or a deadline for answering. It requires a process, a contact, notice to patients and records. Whether your process meets the rule for your setup is a question to talk to your counsel about.
Who receives complaints
Inside the practice, the rule names two roles: a privacy official “responsible for the development and implementation of the policies and procedures of the entity,” and a contact person or office “responsible for receiving complaints under this section” (45 CFR 164.530(a)(1)). See the HIPAA privacy officer guide for what that role covers on the marketing side.
Outside the practice, OCR receives them. HHS says “Anyone can file a complaint if they believe there has been a violation of the HIPAA Rules or Part 2,” and OCR can investigate complaints against covered entities and their business associates (HHS). See who enforces HIPAA.
How patients file with OCR
The rule sets the basics. A complaint must be filed in writing, on paper or electronically; it must name the entity and describe the acts or omissions believed to violate the rules; and it must be filed “within 180 days of when the complainant knew or should have known that the act or omission complained of occurred,” unless HHS waives the limit for good cause (45 CFR 160.306(b)).
HHS accepts complaints “by mail, fax, e-mail, or via the OCR Complaint Portal” (HHS); the portal is at ocrportal.hhs.gov (HHS). A written complaint in your own format should include, per HHS:
- Your name, full address, telephone numbers and email address, if you have one.
- The name, full address and telephone number of the organization or person you believe violated the rules.
- A brief description of what happened: how, why and when.
- Any other relevant information, and your signature and the date.
One condition matters: “OCR does not investigate complaints filed without a name and contact information on the complaint.” You can ask OCR to keep your name confidential during the investigation on the consent form (HHS).
What happens after an OCR complaint
HHS “will investigate any complaint filed under this section when a preliminary review of the facts indicates a possible violation due to willful neglect,” and may investigate any other complaint. An investigation can include a review of the entity's policies, procedures and practices (45 CFR 160.306(c)). At the end, “OCR issues a letter describing the resolution of the investigation.” If the entity may not have complied, it must voluntarily comply, take corrective action or agree to a settlement. If it doesn't resolve the matter, OCR may impose civil money penalties, which the entity can contest before an HHS administrative law judge (HHS).
The volume is large. HHS's enforcement highlights, which run to October 31, 2024, say that “Since the compliance date of the Privacy Rule in April 2003, OCR has received over 374,321 HIPAA complaints.” The issues most often alleged start with impermissible uses and disclosures of PHI, then lack of safeguards and lack of patient access, and private practices and physicians are second among the entity types most often named (HHS).
Complaints about websites and tracking
HHS's tracking bulletin says OCR enforces the HIPAA Rules “including by investigating breach reports and complaints about regulated entities' noncompliance,” and it has a section pointing people to the OCR complaint portal (HHS). Its central line: “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures.” The page also notes that a federal court vacated part of the bulletin on June 20, 2024, the part about IP addresses on unauthenticated public pages about health conditions or providers.
If a patient complains about your website, the rule's steps still apply. Log the complaint and its outcome (45 CFR 164.530(d)(2)). Find out what the page actually sends, and to whom. Mitigate any known harmful effect (45 CFR 164.530(f)). If PHI went somewhere it shouldn't, a disclosure not permitted by the Privacy Rule is presumed to be a breach unless a risk assessment shows a low probability of compromise (45 CFR 164.402). See what triggers an OCR marketing investigation and PHI disclosure rules.
Book a call. Need to know what your pages send before a patient asks? Curve's free website scan lists the pixels and trackers on a page, and Curve's team reviews what your site sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Book a call with Curve.
Documenting complaints
The rule's wording is plain: a covered entity “must document all complaints received, and their disposition, if any” (45 CFR 164.530(d)(2)). The record can be written or electronic, and it is kept for “six years from the date of its creation or the date when it last was in effect, whichever is later” (45 CFR 164.530(j)). The same clock covers the designations of the privacy official and contact, and any sanctions applied to workforce members. See HIPAA document retention requirements.
How Curve Compliance helps
Curve Compliance helps with the complaints a website can cause. Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve then replaces browser ad pixels with one script and sends conversions server-side, with only a fixed list of fields per platform and contact identifiers off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.
Event Logs show what Curve sent to each platform and what the platform accepted, a record you can check when someone asks what your site shared. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry), and Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 164.530; 45 CFR 164.520; 45 CFR 160.306; 45 CFR 160.316; 45 CFR 164.402; HHS, Summary of the HIPAA Privacy Rule; HHS, Filing a Health Information Privacy Complaint; HHS, How to File a Complaint; HHS, What to Expect; HHS, Enforcement Highlights (October 2024); HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
What is the HIPAA complaint process?
Each covered entity must offer a way to complain about its privacy practices and name a contact to receive complaints (45 CFR 164.530). Anyone can also file a written complaint with HHS's Office for Civil Rights, generally within 180 days (45 CFR 160.306).
Who handles HIPAA violation complaints?
The covered entity's designated contact person or office handles complaints made to it (45 CFR 164.530(a)(1)(ii)), and HHS's Office for Civil Rights handles complaints filed with HHS (HHS).
What must a covered entity's complaint process include?
A way to complain, a named contact person or office, a description of the process in the notice of privacy practices, a record of every complaint and its outcome kept for six years, and no retaliation or waivers (45 CFR 164.530; 45 CFR 164.520(b)(1)(vi)).
How do patients file a HIPAA complaint?
In writing, by mail, fax, email or the OCR Complaint Portal, naming the organization and describing what happened (HHS). OCR does not investigate complaints filed without a name and contact information.
How long do you have to file a HIPAA complaint?
Within 180 days of when you knew or should have known about the act or omission, unless HHS waives the limit for good cause (45 CFR 160.306(b)(3)).
Can a practice retaliate against a patient who complains?
No. A covered entity may not threaten, intimidate, coerce, harass, discriminate against or retaliate against anyone for filing a complaint (45 CFR 160.316; 45 CFR 164.530(g)).
How long must complaint records be kept?
Six years from the date the record was created or last in effect, whichever is later (45 CFR 164.530(j)(2)).
How should a clinic respond to a complaint about its website?
Log it and its outcome, check what the page sends and to whom, mitigate any known harm, and assess whether a breach occurred (45 CFR 164.530(d) and (f); 45 CFR 164.402).
Talk to Curve Compliance
Book a call. Want your website off the list of things patients complain about? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Book a call with Curve.