OCR and HIPAA complaint prep

Prepare a privacy, records, HIPAA, Part 2, or civil rights complaint without guessing.

HHS OCR has different complaint routes for health information privacy, Part 2 confidentiality, civil rights, and other matters. This worksheet helps patients organize the entity, dates, acts or omissions, prior steps, documents, and deadline questions before using an official filing process.

Browser-only organizerUse the tool first. Read the education after if you need more context.

Nothing on this page uploads, saves, emails, submits, or stores patient information. Keep drafts factual, remove unnecessary private details, and send sensitive information only through the proper official channel.

Start organizer All tools

Find another organizerUse the searchable tool library when the problem has more than one piece.All tools →Protect private detailsReview what should be removed before sharing a draft, summary, or record note.Privacy check →Start over cleanlyUse Quick Start when the issue is tangled between doctors, pharmacies, insurers, and records.Quick Start →

OCR complaint prep

Prepare the facts before using an official OCR filing route.

This browser-only worksheet helps patients separate HIPAA, Part 2, records, privacy, security, and health-care civil rights concerns before filing or following up.

Medical records access problemFor HIPAA privacy, security, breach-notification, or records-access concerns, OCR asks for a written complaint that names the covered entity or business associate and describes the acts or omissions believed to violate the rules.

Complaint typeFiling stage

Patient or complainantEntity involved

Date you knew of the act or omissionWhat happenedRights or process concernSteps already takenDocuments or proof availableDeadline or good-cause issue to verifyRequested handling or question

Generated worksheet

OCR complaint preparation worksheet

Patient or complainant: [Name or leave blank for your own worksheet]
Complaint type: Medical records access problem
Filing stage: Preparing before filing
Entity involved: [Covered entity, business associate, Part 2 program, lawful holder, health care provider, plan, or social service provider]
Date you knew of the act or omission: [Date or date range]

What happened:
[Describe the acts or omissions in date order. Keep this focused on the records, privacy, security, breach, Part 2, or civil rights issue.]

Rights or process concern:
[Explain the privacy, records access, amendment, disclosure, security, confidentiality, or civil rights concern you believe is involved.]

Steps already taken:
[List records requests, privacy-office contacts, portal messages, calls, correction requests, denial letters, reference numbers, or responses received.]

Documents or proof available:
[List supporting documents without pasting full records: request copies, denial letters, portal messages, screenshots, reference numbers, or dates of calls.]

Deadline or good-cause issue to verify:
[OCR materials describe a 180-day complaint timing rule for HIPAA/privacy and civil rights complaints, with possible extension for good cause. Verify timing directly before relying on this worksheet.]

Requested handling or question:
[Ask for review under the appropriate OCR process, clarification of filing requirements, or confirmation of what information is needed.]

Route reminder:
For HIPAA privacy, security, breach-notification, or records-access concerns, OCR asks for a written complaint that names the covered entity or business associate and describes the acts or omissions believed to violate the rules.

Privacy note:
Use the official OCR portal or official filing method. Do not send unnecessary records, Social Security numbers, insurance-card images, login credentials, or unrelated medical history. This worksheet does not file anything and does not provide legal advice.

What OCR complaint materials generally require

HHS OCR explains that health information privacy complaints generally must be filed in writing, name the covered entity or business associate involved, describe the acts or omissions believed to violate the rules, and be filed within 180 days of when the complainant knew of the act or omission, unless OCR extends the period for good cause.

Different OCR routes should not be mixed together blindly

A HIPAA privacy complaint, a Part 2 substance use disorder records complaint, and a health-care civil rights complaint may involve different facts and official instructions. The patient should match the worksheet to the specific OCR complaint route before sending anything.

HIPAA privacy, security, breach notification, or records access concern.
Part 2 substance use disorder confidentiality concern.
Civil rights concern involving health care or social services.
Patient safety confidentiality or breach notification concern if the official OCR route applies.

Privacy-first boundary

This builder is not an OCR filing portal and does not upload or submit information. Patients should avoid unnecessary records, identification numbers, full medical histories, insurance-card images, and unrelated private details unless the official process requires them.

Sources

References used for this page.

These links are provided for transparency. They support general education and advocacy content, not individualized medical or legal advice.

HHS OCR — Filing with OCROverview of OCR complaint categories, including civil rights, conscience/religious freedom, health information privacy, Part 2, patient safety confidentiality, and breach notification.HHS — How to File a Health Information Privacy or Security ComplaintOCR complaint requirements for HIPAA/Part 2, including written filing, naming the entity, describing acts or omissions, and 180-day timing language.HHS — How to File a Civil Rights ComplaintCivil rights complaint requirements, filing routes, 180-day timing language, and information OCR asks complainants to include.

Need to build a general packet first?

Use the complaint packet builder to organize facts, then tailor the packet to OCR's official filing route.

Build complaint packet