A patient says they are filing a HIPAA complaint
Stay calm, document everything, and notify your privacy officer immediately.
- 1
Do not argue or dismiss the patient
Listen politely. Thank them for letting you know. Escalate to the privacy officer rather than debating the law at the front desk.
- 2
Document the interaction
Write down what the patient said, who was involved, and the date and time. Preserve any related records or logs.
- 3
Notify your privacy officer the same day
They will assess the concern, determine if there was a violation, and prepare a response if OCR reaches out.
- 4
Do not alter records
Never delete or change documentation after a complaint. That can create far worse legal exposure.
Important
Many OCR investigations start with patient complaints. Early, documented response helps your practice.
Related
Still unsure? Ask AI about this situation →
Not legal advice. Follow your organization's policies and consult counsel for legal questions.