U.S. Department of Health & Human Services

About Us

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), enforces federal civil rights laws, conscience laws, the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules, and the Patient Safety Act and Rule. Together, these laws protect your fundamental rights of nondiscrimination, conscience, and health information privacy and security at entities that are bound by the laws.

1. Federal Civil Rights and Conscience Laws help to protect you from unfair treatment or discrimination because of your race, color, national origin, disability, age, sex, religion or conscience.

If you believe that a Civil Rights covered entity discriminated against you or someone else because of your or someone else’s race, color, national origin, disability, age, sex, or religion in violation of federal civil rights laws under HHS jurisdiction or has otherwise violated federal provider conscience laws, you may file a Civil Rights and Conscience complaint with OCR.

The following are some examples of potential covered entities (including institutions and personnel) that must abide by federal civil rights laws:

State and local government agencies responsible for administering health care
State and local government income assistance and human services agencies
Tribal organizations and tribal consortia
Hospitals and out-patient clinics
Medicaid and Medicare Providers
Physicians and other health care professionals in private practice with patients assisted by Medicaid
Family health centers
Behavioral Health Clinic
Alcohol and substance use disorders, treatment providers
Nursing homes and long-term care facilities
Child welfare agencies
Foster care homes and residential treatment programs
Public and private adoption and foster care agencies
State court systems
Head Start and childcare centers
Senior citizen centers
Senior and Infant nutrition programs
Any entity established under the Affordable Care Act, including State and Federal Health Insurance Exchanges
Health insurance plans or companies
HMOs
Pharmacies
Homeless shelters
Health researchers

2. Health Information Privacy and Security Laws.

The HIPAA Privacy, Security, and Breach Notification Rules (“HIPAA Rules”) are federal laws that give you rights over certain identifiable health information about you (called “protected health information”), set rules and limits on who can look at and receive the information, require security for the information in electronic form, and require certain entities to provide you with notice if there is a breach of the privacy or security of the information.

The following are the three types of HIPAA covered entities that must meet the requirements of the HIPAA Rules:

Health plans
Health care clearinghouses
Health care providers that conduct any portion of their business electronically using a HIPAA covered transaction

In addition, business associates of covered entities (generally, a company or other person who conducts certain functions and services for a covered entity and has access to protected health information) are required to comply with the Security Rule and certain parts of the Privacy and Breach Notification Rules. Some examples of business associate functions and services include the following, if they are done by someone who is not an workforce member of a covered entity:

Claims processing
Billing
Data analysis
Quality assurance
Legal services
Accounting
Data aggregation
Management

The Patient Safety Rule provides confidentiality protections for information called “patient safety work product” that is used to analyze patient safety events, identify causes, and improve health care quality. Providers, patient safety organizations (PSOs), and responsible persons that hold patient safety work product must meet the confidentiality requirements of the Patient Safety Rule.

You may file a complaint with OCR if you believe that a HIPAA covered entity or business associate violated the HIPAA Rules, or that a provider, PSO, or responsible person has violated the confidentiality requirements of the Patient Safety Rule. You may file a complaint for yourself or for someone else.

Click here to file a complaint

If you are an individual with a disability and require an accommodation to access OCR services, language interpreter services, or if you would like to be provided with this Complaint Form in another language please contact our Customer Response Center: 1-800-368-1019 (voice) or TDD: 800-537-7697 ; you may also send an email message to OCRMail@hhs.gov or fax to (202) 619-3818.

U.S. Department of Health and Human Services Office for Civil Rights Complaint Portal

About Us

U.S. Department of Health and Human Services
Office for Civil Rights

Complaint Portal