Part 2: Basic Patient Rights (FAQ 50 of 65)

Right to Complain to the Secretary of HHS

50. Should I Worry that a Covered Entity will Retaliate if I File a Complaint?

Each covered entity's notice of privacy practices must say that there will be no retaliation against a person who files a complaint. We would like to believe that.

But in the real world, there are no guarantees. We have seen, for example, a notice from a hospital that says – as required by the rule – that there will be no retaliation. The next sentence in the notice says more ominously that the hospital reserves the right “to take necessary and appropriate action to maintain an environment that serves the best interests of out patients and staff.” We have no idea what that means or why the hospital chose to add that statement directly after the required language about not taking retaliation. But it sure sounds like a threat to us.

We would be happier to see a privacy notice that included a statement to the effect that the hospital reserves the right to take additional actions to protect the privacy of its patients. However, hospital lawyers don't like statements like that, lest they be interpreted to oblige the hospital to do more than the bare minimum.

Is There Another Way to Protest a Privacy Violation?

We think that the first step should always be to complain directly to the covered entity that did something you think was wrong. Each covered entity has a privacy officer, and the name, address, and telephone number of the privacy officer should be included in the notice of privacy practices. Everyone makes mistakes, and everyone deserves the chance to make things right. It is also important for covered entities to know that people pay attention to privacy and that people care when privacy violations occur.

If the covered entity does not satisfy you, then you can look elsewhere. We don't think that every minor violation should become a federal case. Consider complaining locally about any violation. You get to make the choice. Remember too that filing a complaint may bring more attention to you and to your health record. You may want to be guarded about how much of your personal medical information you include in the complaint. In other words, the complaint process may further invade your privacy. You can ask that you name be masked or changed as part of the complaint, and some authorities may be willing to do so.

Here are some ideas if you want to pursue your complaint.

• Complain to the Secretary as described above. We can't tell you that it will help, but it could, it is easy to do, and it costs nothing.
• If you do complain to the Secretary, consider sending a copy of your complaint to your congressman or Senators. Ask them to write to the Secretary and report back about what happens to the complaint. When an elected official writes to an agency on behalf of a constituent, the constituent's file gets a pink slip and faster attention. The downside may be sharing your personal information more widely.
• You might be able to complain to a state official. Every state has a health department and an insurance department. If your complaint is about a health care provider, complain to the health department. If the complaint is about an insurer, complain to the insurance department.
• Health care providers hold licenses from state boards. If the violation is serious, see if the state licensing board accepts public complaints.
• If your problem is newsworthy and you are willing to make it public, you might look for a local reporter who covers health issues and who may be interested in your story. Remember that going public may just make the privacy violation worse, but it may get better results.
• Use the Web. You may find websites where you can post your story and the basics of your complaint.
• Tell your friends and neighbors. A national insurance company may not care what you say. However, local providers and local hospitals care a lot. A bad reputation can result in the loss of clients and revenues.
• HIPAA does not provide patients with the right to sue covered entities. However, other law may allow you to sue. If the courts recognize that HIPAA establishes a standard of care, then it may be possible to sue for breach of contract, malpractice, violation of standards of professional conduct, or on other grounds. Lawsuits are not fun, and they can be expensive. Finding a lawyer willing to take a privacy case can be hard. Obtaining damages can be highly uncertain. Lawsuits are remedies to be pursued only for major problems.

Jump to list of FAQs 1-65 | See all of Part 2