U.S. Department of Health and Human Services
Office for Civil Rights
Complaint Portal

Person sitting at a laptop

Every complaint that the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) receives is important. However, not every complaint results in an investigation, and it is not possible to contact every complainant.

File a Civil Rights and Conscience Complaint

If you believe that a Civil Rights covered entity discriminated against you or someone else because of your or someone’s race, color, national origin, disability, age, sex, or religion in violation of federal civil rights laws under HHS jurisdiction or has otherwise violated federal provider conscience laws, you may file a Civil Rights and Conscience complaint with OCR.

A Civil Rights covered entity includes programs or activities that receive federal financial assistance from HHS and may include programs or activities that HHS directly operates and programs or activities that receive federal assistance from HHS. For complaints alleging disability discrimination, a covered entity may also include services, programs, or activities operated by a state and local governmental agency and its political subdivisions. You may file a Civil Rights and Conscience complaint for yourself or for someone else.

The following are some examples of potential covered entities (including institutions and personnel) that must abide by federal civil rights laws:

  • State and local government agencies that are responsible for administering health care
  • State and local government income assistance and human services agencies
  • Hospitals
  • Medicaid and Medicare Providers
  • Physicians and other health care professionals in private practice with patients assisted by Medicaid
  • Family health centers
  • Community mental health centers
  • Alcohol and drug treatment centers
  • Nursing homes
  • Foster care homes
  • Public and private adoption and foster care agencies
  • Day care centers
  • Senior citizen centers
  • Senior and Infant nutrition programs
  • Any entity established under the Affordable Care Act, including State and Federal Health Insurance Exchanges
  • Health insurance plans or companies
  • HMOs
  • Pharmacies
  • Homeless shelters
  • Health researchers

File a Health Information Privacy Complaint

File a Security Rule Violation Complaint

If you believe that a HIPAA covered entity or business associate violated the Privacy, Security, or Breach Notification Rules (the HIPAA Rules), you may file a Health Information Privacy & Security complaint with OCR. OCR can investigate complaints alleging violations of the HIPAA Rules against HIPAA covered entities and their business associates. You may file a Health Information Privacy & Security complaint for yourself or for someone else.

The following are HIPAA covered entities that must meet the requirements of the Federal Privacy, Security, and Breach Notification Rules:

  • Health Plans
  • Health care clearinghouses
  • Health care providers that conduct a portion of their business electronically using a HIPAA covered transaction


A HIPAA business associate is a person or entity that creates, receives, maintains, or transmits protected health information on behalf of a covered entity for a covered function, or provides certain services to or for such covered entity where the provision of the services includes the disclosure of protected health information. The following are some examples of potential HIPAA business associates:
  • Other covered entities
  • Law firms or lawyers who represent HIPAA covered entities
  • Secure document shredding/disposal services
  • Cloud service, server, and other IT service providers
  • Interpreter or translation service providers.

When OCR receives a complaint, we review it to determine whether we have legal authority to investigate the complaint. OCR may close the complaint based on a review of the facts presented by the complainant. OCR may act on complaints if a covered entity (or business associate of a HIPAA covered entity) allegedly violated any of the regulations enforced by OCR, and if the complaint is filed within 180 days of the alleged violation (or 180 days from when the individual should have known of an alleged violation of the HIPAA Rules). OCR may resolve the complaint with technical assistance, refer the complaint to another agency for appropriate action, investigate the complaint, or close the complaint without further investigation.

Upon the completion of an investigation, OCR will issue a letter notifying the complainant that the investigation has been closed. The letter may include the steps that OCR took to address the issues raised and/or that the covered entity (or HIPAA business associate) took to respond to OCR’s investigation. In some cases, OCR may negotiate a written agreement and corrective action steps with the covered entity (or HIPAA business associate) to resolve the compliance issues identified during OCR’s investigation.


If you are an individual with a disability and require an accommodation to access OCR services, language interpreter services, or if you would like to be provided with this Complaint Form in another language please contact our Customer Response Center: 1-800-368-1019 (voice) or TDD: 800-537-7697 ; you may also send an email message to OCRMail@hhs.gov or fax to (202) 619-3818.

  
U.S. Department of Health & Human Services - 200 Independence Avenue, S.W. - Washington, D.C. 20201 HHS Vulnerability Disclosure