A person who believes a covered entity or business associate is not complying with HIPAA's administrative simplification provisions may file a complaint with the Secretary of Health and Human Services (HHS).
- A complaint must be filed in writing on paper or electronically.
- A complaint must name the person who is the subject of the complaint and describe the acts or omissions believed to violate the applicable administrative simplification provision(s).
- A complaint must be filed within 180 days of when the complainant knew or should have known that the act or omission complained of occurred (the HHS Secretary may waive this time limit if there is good cause).
Compliance violations are further investigated by the HHS Secretary, who will then decide if a civil penalty is appropriate.
