How to complain when your privacy has been mishandled
Two routes exist and they are not alternatives — you can use both. What matters most is the deadline, because the federal route closes 180 days after you knew about the problem and no amount of internal back-and-forth pauses that clock.
Two routes
Internal and federal, in parallel
Faster, and often sufficient. Most privacy problems are process failures rather than misconduct, and are fixed quickly once identified.
Put it in writing with dates, what happened and what you want done.
Retaliation is prohibited. Complaining cannot lawfully affect your evaluation or your standing as a patient.
Independent and free. Filed with the federal Department of Health and Human Services; no lawyer required.
180 days from when you knew or should have known, with extensions only for good cause.
You do not need to complain internally first. The routes are independent.
What to include in an OCR complaint
Your name and contact details
The name of the organisation involved
A description of what happened, with dates
Which of your rights you believe was violated
Copies of the correspondence, if you have it
What OCR can and cannot do
Can: investigate, require corrective action, impose penalties and publish findings.
Cannot: award you compensation. HIPAA provides no private right to damages — a claim for personal loss belongs in a state-law action, not an OCR complaint.
Complaints that go to the wrong place
A large share of privacy complaints about ESA letters are really housing complaints, and they stall because they were filed with the wrong regulator. The distinction is simple: HIPAA governs the clinician; fair housing law governs the landlord.
Frequently asked
How long do I have to file a HIPAA complaint?
180 days from when you knew or should have known about the problem. Extensions are possible for good cause but should not be relied on.
Do I need a lawyer to file with OCR?
No. The process is designed to be used directly by individuals and there is no filing fee.
Can I get compensation through a HIPAA complaint?
No. HIPAA has no private right of action for damages. OCR can require corrective action and impose penalties, but any claim for personal loss would be a separate state-law matter.
Will complaining affect my evaluation or my letter?
It must not. Retaliation against someone for exercising a HIPAA right, including complaining, is itself prohibited.
My landlord shared my letter — is that a HIPAA breach?
Almost certainly not, because your landlord is not a covered entity. HIPAA binds clinicians and their business associates; a landlord’s conduct is a fair housing or state privacy matter.
Should I complain internally before going to OCR?
You may, and it is often faster, but you are not required to. The two routes are independent and you can use both at once.
Your privacy is not an afterthought here
Start a free evaluation and see exactly what your landlord will — and will not — receive.
Start free evaluation All privacy topics