A nurse in Texas notices a coworker pulling up her ex-husband's medical records during a slow shift. She knows it's wrong. She tells a friend about it. But she never reports it — because she doesn't know how. Six months later, the same coworker accesses records for a neighbor going through a custody battle. That information ends up in a courtroom. The hospital faces an OCR investigation, and the nurse who stayed silent wonders if she could have stopped it. If you've ever wanted to report a HIPAA violation but didn't know where to start, this guide walks you through every step.

Why People Search "Report a HIPPA Violation" — And Why the Spelling Matters Less Than the Action

Let's address the elephant in the room. The correct acronym is HIPAA — Health Insurance Portability and Accountability Act. But thousands of people search "report a HIPPA violation" every month. The misspelling doesn't change the urgency behind the search.

People land on this question because they've witnessed something that doesn't sit right. Maybe a receptionist gossiped about a patient's diagnosis. Maybe a clinic texted lab results to the wrong phone number. Maybe a family member's PHI showed up on social media.

Whatever brought you here, you deserve a clear answer. And the process is more straightforward than most people think.

What Counts as a HIPAA Violation Worth Reporting

Not every awkward moment in a doctor's office is a HIPAA violation. But many are. Here's how I explain it to the organizations I work with: if someone accessed, used, or disclosed protected health information without authorization or a valid reason, that's a potential violation.

Common Scenarios I've Seen Reported

  • Snooping in medical records: Employees looking up records for patients they aren't treating. This is one of the most common violations and one of the easiest to prove through audit logs.
  • Social media disclosures: A staff member posts a photo from inside a treatment room, and a patient's chart is visible in the background. Or worse — they name the patient directly.
  • Improper disposal of records: Paper records tossed in regular trash bins instead of shredded. Laptops with ePHI donated without being wiped.
  • Unauthorized sharing: A provider shares a patient's information with a family member the patient hasn't authorized.
  • Failure to provide access: A covered entity refuses to give a patient their own medical records within the required timeframe.

If any of these sound familiar, you have grounds to file a complaint. Our course on Accessing Records: If It's Not Your Job, It's a Breach covers the snooping problem in detail — it's the violation type that generates the most internal complaints I see.

Step 1: Report Internally First (If You Can)

Most covered entities — hospitals, clinics, health plans, clearinghouses — are required to have an internal complaint process. They must also designate a Privacy Officer. If you're a workforce member, this is almost always your first step.

Here's what I tell employees: document everything before you walk into that Privacy Officer's office. Write down dates, times, what you saw, and who was involved. Screenshots help if they're available and don't themselves violate policy.

Internal reporting matters because many organizations genuinely want to fix problems before they escalate to an OCR investigation. A quick internal correction — retraining, discipline, process change — can prevent a much bigger breach down the road.

But what if your organization ignores you? What if the Privacy Officer is the problem? That's when you go external.

Step 2: File a Complaint with the Office for Civil Rights (OCR)

Who Is OCR and What Do They Do?

The Office for Civil Rights within the U.S. Department of Health and Human Services (HHS) enforces HIPAA. They investigate complaints, conduct compliance reviews, and impose penalties that range from corrective action plans to multimillion-dollar settlements.

How to File Your OCR Complaint

You can report a HIPAA violation directly to OCR through their online complaint portal. Here's the exact process:

  • Visit the HHS HIPAA Complaint page.
  • You can file online using the OCR Complaint Portal, or download a PDF complaint form and mail or fax it.
  • Include: the name of the entity you're filing against, what happened, when it happened, and how you believe HIPAA was violated.
  • You must file within 180 days of when you discovered the violation (OCR can waive this deadline for good cause).

OCR does not require you to be a patient. Workforce members, business associates, and even members of the public can file complaints. And here's something many people don't know: HIPAA's anti-retaliation provision prohibits covered entities from retaliating against anyone who files a complaint.

What Happens After You File

OCR reviews every complaint. Not all lead to investigations — some are resolved through technical assistance to the covered entity. But when OCR does investigate, they have teeth.

In 2023, OCR settled with Yakima Valley Memorial Hospital for $240,000 after 23 security guards were found to have accessed patient medical records without any treatment, payment, or operations reason. That case started because someone reported it. Snooping cases almost always do.

The $4.75 Million Question: What Real Enforcement Looks Like

If you're wondering whether reporting actually leads to consequences, consider this: in 2024, OCR settled with Montefiore Medical Center for $4.75 million after a workforce member stole the PHI of 12,517 patients and sold it to identity theft rings. The investigation revealed that Montefiore failed to conduct a thorough risk analysis and didn't have sufficient monitoring in place.

That case reinforced something I've been saying for years: workforce training isn't optional, and neither is monitoring access logs for ePHI. If your organization hasn't trained staff on what to do in the first hour after discovering a breach, our First 60 Minutes: Incident Response course fills that gap fast.

Step 3: Consider Your State Attorney General

HIPAA isn't the only law protecting health information. Every state attorney general has the authority to bring civil actions under the HITECH Act on behalf of state residents. Some states — like California, New York, and Texas — also have their own health privacy laws with separate complaint processes.

If your complaint involves a large-scale breach affecting many people, or if you feel OCR isn't acting quickly enough, filing a parallel complaint with your state AG's office adds another layer of accountability. You can typically find the complaint form on your state attorney general's website.

Can You Report a HIPAA Violation Anonymously?

This is one of the most common questions I get, so let me answer it directly.

Yes, you can file an OCR complaint without including your name. However, OCR strongly encourages you to provide contact information so they can follow up. Anonymous complaints are harder to investigate because OCR can't ask clarifying questions. If you're a workforce member afraid of retaliation, know that HIPAA explicitly prohibits it — and OCR takes retaliation claims seriously.

Internally, many organizations also offer anonymous hotlines or compliance reporting systems. Ask your Privacy Officer or check your employee handbook.

What You Should Never Do

I've seen well-meaning people make mistakes that actually hurt their case. Here's what to avoid:

  • Don't post about it on social media. If you witnessed a PHI breach, publicly discussing the details — even to call out wrongdoing — can create additional privacy violations. Our Social Media & PHI training covers exactly why this backfires.
  • Don't access systems to gather "evidence." If you're not authorized to view those records, pulling them up to prove your point makes you part of the problem.
  • Don't wait. The 180-day filing window is real. And the longer you wait, the harder it becomes for investigators to find audit trail evidence.

What Happens to the Organization After a Report

OCR's enforcement process has several possible outcomes, depending on severity and cooperation:

  • Technical assistance: For minor or first-time issues, OCR may simply educate the covered entity on what they need to fix.
  • Voluntary compliance and corrective action plans: The entity agrees to specific changes — updated policies, workforce training, improved safeguards — under OCR's monitoring.
  • Resolution agreements and monetary settlements: For serious or prolonged violations, OCR negotiates a financial settlement. These are the cases that make headlines.
  • Civil monetary penalties: If an entity refuses to cooperate, OCR can impose penalties up to $2,067,813 per violation category per year, adjusted annually for inflation. The penalty structure is outlined on the HHS Enforcement page.

Your Report Could Protect Thousands of Patients

Every major HIPAA enforcement action I've studied started with someone deciding to speak up. A patient who noticed something wrong on their Explanation of Benefits. An IT analyst who flagged suspicious access patterns. A nurse who refused to look the other way.

If you're reading this because you want to report a HIPAA violation, you already know something isn't right. Trust that instinct. Document what you saw, report it internally if safe, and file with OCR if needed. The process exists specifically for situations like yours.

And if you're on the other side — an organization trying to make sure your workforce never puts you in this position — start with training that addresses the real risks. Browse our full HIPAA training catalog and build a culture where your team catches problems before OCR does.