HHS Sets Privacy Complaint Process

[Federal Register: March 20, 2003 (Volume 68, Number 54)]
[Notices]
[Page 13711-13712]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr20mr03-67]

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office for Civil Rights

Notice of Addresses for Submission of HIPAA Health Information Privacy Complaints

AGENCY: Office for Civil Rights, HHS.

ACTION: Notification of addresses for submission of HIPAA Health Information Privacy Complaints for violations occurring on or after April 14, 2003.

SUMMARY: This notice sets out the addresses for filing a complaint with the Secretary of the Department of Health and Human Services, for non-compliance by a covered entity with the standards for privacy of individually identifiable health information under 45 CFR parts 160 and 164 (the Privacy Rule). The Privacy Rule implements certain provisions of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191. Complaints must be submitted in writing to the Office for Civil Rights at the appropriate address, as described below.

EFFECTIVE DATES: April 14, 2003.

ADDRESSES: See SUPPLEMENTARY INFORMATION section for the list of addresses for filing complaints.

SUPPLEMENTARY INFORMATION: 45 CFR section 160.306 establishes general provisions for submission of complaints against a covered entity for
non-compliance with the HIPAA Privacy Rule. A person who believes a covered entity is not complying with these requirements may file a complaint with the Secretary. A covered entity is a health plan, health care clearinghouse, and any health care provider who conducts certain health care transactions electronically. Complaints to the Secretary must:

1. Be filed in writing, either on paper or electronically;
2. name the entity that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable requirements of part 160 or the applicable standards, requirements, and implementation specifications of subpart E of part 164; and
3. be filed within 180 days of when the complainant knew or should have known that the act or omission complained of occurred, unless this time limit is waived by the Office for Civil Rights for good cause shown.

Complaints to the Secretary may be filed only with respect to alleged violations occurring on or after April 14, 2003.

The Secretary has delegated to the Office for Civil Rights (OCR) the authority to receive and investigate complaints as they may relate to the Privacy Rule. See 65 FR 82381 (Dec. 28, 2000). Individuals may file written complaints with OCR by mail, fax or email at the addresses listed below. Individuals may, but are not required to, use OCR's Health Information Privacy Complaint Form. To obtain a copy of this form, or for more information about the Privacy Rule or how to file a complaint with OCR, contact any OCR office or go to www.hhs.gov/ocr/hipaa/. For more information on what entities are covered by HIPAA, go to www.cms/hipaa/hipaa2/support/tools/decisionsupport/default.asp.

As listed below, health information privacy complaints to the Secretary should be addressed to the OCR regional office that is responsible for matters relating to the Privacy Rule arising in the State or jurisdiction where the covered entity is located. Complaints may also be filed via email at the address noted below.

Where To File Complaints Concerning Health Information Privacy

For complaints involving covered entities located in Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, or Vermont:

Voice phone (617) 565-1340. FAX (617) 565-3809. TDD (617) 565-1343.

For complaints involving covered entities located in New Jersey, New York, Puerto Rico, or Virgin Islands:

Voice Phone (212) 264-3313. FAX (212) 264-3039. TDD (212) 264-2355.

For complaints involving covered entities located in Delaware, District of Columbia, Maryland, Pennsylvania, Virginia, or West Virginia:

Main Line (215) 861-4441. Hotline (800) 368-1019. FAX (215) 861-4431. TDD (215) 861-4440.

For complaints involving covered entities located in Alabama, Florida, Georgia, Kentucky, Mississippi, North Carolina, South Carolina, or Tennessee:

Voice Phone (404) 562-7886. FAX (404) 562-7881. TDD (404) 331-2867.

For complaints involving covered entities located in Illinois, Indiana, Michigan, Minnesota, Ohio, or Wisconsin:

Voice Phone (312) 886-2359. FAX (312) 886-1807. TDD (312) 353-5693.

For complaints involving covered entities located in Arkansas, Louisiana, New Mexico, Oklahoma, or Texas:

Voice Phone (214) 767-4056. FAX (214) 767-0432. TDD (214) 767-8940.

For complaints involving covered entities located in Iowa, Kansas, Missouri, or Nebraska:

Voice Phone (816) 426-7278. FAX (816) 426-3686. TDD (816) 426-7065.

For complaints involving covered entities located in Colorado, Montana, North Dakota, South Dakota, Utah, or Wyoming:

Voice Phone (303) 844-2024. FAX (303) 844-2025. TDD (303) 844-3439.

For complaints involving covered entities located in American Samoa, Arizona, California, Guam, Hawaii, or Nevada:

Voice Phone (415) 437-8310. FAX (415) 437-8329. TDD (415) 437-8311.

For complaints involving covered entities located in Alaska, Idaho, Oregon, or Washington:

Voice Phone (206) 615-2287. FAX (206) 615-2297. TDD (206) 615-2296.

For all complaints filed by email send to: OCRComplaint@hhs.gov.

FOR FURTHER INFORMATION CONTACT:

Telephone number: (202) 205-8725.

Dated: March 12, 2003.
Richard M. Campanelli,
Director, Office for Civil Rights.
[FR Doc. 03-6651 Filed 3-19-03; 8:45 am]

BILLING CODE 4153-01-P

Go to TOP