A patient says they are filing a HIPAA complaint
Stay calm, document everything, and notify your privacy officer immediately.
- 1
Do not argue or dismiss the patient
Listen politely. Thank them for letting you know. Escalate to the privacy officer rather than debating the law at the front desk.
- 2
Document the interaction
Write down what the patient said, who was involved, and the date and time. Preserve any related records or logs.
- 3
Notify your privacy officer the same day
They will assess the concern, determine if there was a violation, and prepare a response if OCR reaches out.
- 4
Do not alter records
Never delete or change documentation after a complaint. That can create far worse legal exposure.
Important
Many OCR investigations start with patient complaints. Early, documented response helps your practice.
Related
Not legal advice. Follow your organization's policies and consult counsel for legal questions.