Skip to Main Content Skip to Footer Toggle Navigation Menu

14.13 Privacy Complaint Procedure


Individuals, family members, employees, the general public, or business associates have the right to file complaints regarding Health Plan policies, procedures, or practices relative to the access, use, or disclosure of protected health information (PHI).


Designation of Person to Receive ComplaintsThe HIPAA Privacy Officer has been designated as the individual responsible for receiving, processing, and investigating all privacy related complaints. The Privacy Officer may in turn designate employees in particular areas to assist.
Filing of Privacy ComplaintsAny individual, representative, family member, employee, business associate, visitor, or the general public may file a grievance or complaint regarding Health Plan privacy practices (e.g., denial of access to PHI, amendment of health records, problems with business associates, privacy act/ policy violations, etc.) without fear or reprisal or retaliation in any form.
Submitted ComplaintsComplaints should be submitted to the HIPAA Privacy Officer in writing.
Investigation ProcessThe HIPAA Privacy Officer or his/her designee will begin an investigation into allegations within five (5) working days of the receipt of the complaint.
Results of InvestigationA written report of the findings of the investigation will be provided to the individual filing the complaint within thirty (30) days of receiving such complaint unless an extension is necessary to complete the investigation. Such extension may not exceed thirty (30) days.
Dissatisfaction of Investigation/ResolutionShould the individual not be satisfied with the result of the investigation, or the recommended resolution(s), he/she may file a complaint with the Secretary of Health and Human Services (HHS).
Filing Complaints with the Secretary of HHSComplaints may be filed directly with the Secretary of HHS. Such complaints must be in writing, identify the Health Plan, and must describe the violation. Complaints must be filed within one-hundred eighty (180) days of the complainant learning of the alleged violation or should have been aware of the alleged violation.
Address of Secretary of HHSThe address of the Secretary of HHS is located in the Notice of Privacy Practices (NPP) and/or made available to individuals. Persons may also obtain the address from the HIPAA Privacy Officer.
Retention of Complaints LogThe HIPAA Privacy Officer or his/her designee will maintain a log of all complaints received. Copies of all complaints, their disposition and resolutions, and our complaint log will be maintained for a period of at least six (6) years from the date such complaint was received.
Record RetentionA copy of all HIPAA covered information and any revisions shall be maintained for a period of at least six (6) years. Such retention may be in printed or electronic format, or both.
Privacy OfficerThe Privacy Officer is responsible for the development and implementation of the HIPAA policies and procedures. The Privacy Officer is also the contact person for any questions or complaints regarding HIPAA. Questions or concerns about HIPAA rights should be directed to the Privacy Officer during regular business office hours Monday through Friday, except holidays, at (651) 696-6280.
ViolationsViolations of this policy will be subject to discipline.