Last year, a patient in Tennessee discovered that a hospital employee had been snooping through her medical records for months — not for treatment, not for billing, but out of personal curiosity. She called the hospital's front desk, got transferred three times, and eventually gave up. It took her another six weeks to figure out she could report a HIPAA violation directly to the federal government. By the time she filed, the employee had accessed dozens of other patients' records too.

I hear stories like this constantly. People know their privacy was violated. They just don't know what to do about it. This guide walks you through exactly how to report a HIPAA violation — whether you're a patient, a workforce member, or a concerned bystander — and what actually happens after you file.

Who Can Report a HIPAA Violation?

Anyone. You don't need to be a lawyer. You don't need to be the person whose PHI was exposed. You don't even need to work in healthcare.

The Office for Civil Rights (OCR) at HHS accepts complaints from patients, employees, family members, advocates, and anonymous tipsters. If you witnessed a covered entity or business associate mishandling protected health information, you have standing to file.

In my experience, the most impactful complaints come from two groups: patients who caught unauthorized access to their records, and employees who witnessed their own organization cutting corners. Both carry weight with OCR investigators.

The 3 Places You Can Report a HIPAA Violation

1. The Office for Civil Rights (OCR)

This is the primary federal enforcement agency for HIPAA. OCR investigates complaints, conducts compliance reviews, and issues penalties that have collectively exceeded $140 million since the program's inception.

You can file a complaint online through the HHS OCR Complaint Portal. You can also mail or fax a completed complaint form. The online portal is the fastest route — most submissions are acknowledged within days.

Key details OCR needs from you:

  • The name and address of the entity you're filing against
  • A description of what happened, including dates
  • How you believe HIPAA was violated
  • Your contact information (anonymous complaints are accepted but harder for OCR to investigate)

You have 180 days from when you discovered the violation to file. OCR can waive this deadline for good cause, but don't count on it. File promptly.

2. Your Employer or the Covered Entity's Privacy Officer

Every covered entity is required by law to designate a Privacy Officer. If you're a workforce member and you witness a violation — a coworker pulling up a celebrity's chart, a fax sent to the wrong number, an unencrypted laptop left in a car — your first step should be an internal report.

Why? Because HIPAA's enforcement framework actually gives organizations credit for catching and correcting problems quickly. I've seen organizations avoid six-figure penalties because an employee flagged an issue internally before it spiraled.

That said, internal reporting should never be your only step if you believe the organization itself is the problem. You're protected from retaliation under HIPAA's workforce provisions — and if your employer retaliates, that's a separate violation you can report to OCR.

3. Your State Attorney General

Since the HITECH Act of 2009, state attorneys general have independent authority to bring civil actions for HIPAA violations on behalf of state residents. Several states — Connecticut, Indiana, Massachusetts, and New York among them — have been aggressive about using this power.

If your state AG has a health privacy complaint form, use it as a parallel channel. Some states investigate faster than OCR, especially when the violation affects a large number of residents.

What Happens After You Report a HIPAA Violation to OCR?

Here's what most people don't realize: filing a complaint doesn't guarantee an investigation. OCR triages every submission. They look at jurisdiction (is this actually a HIPAA-covered entity?), timeliness, and severity.

If OCR opens a case, the covered entity receives a notification letter and a data request. The entity must respond within a set timeframe — usually 30 days. OCR reviews documents, interviews staff, and determines whether a violation occurred.

Outcomes range from technical assistance (essentially a warning with guidance) to resolution agreements with corrective action plans to civil monetary penalties. In serious cases, OCR refers matters to the Department of Justice for criminal prosecution.

Real Enforcement: What OCR Penalties Look Like

Let me give you a concrete example. In 2023, OCR settled with Yakima Valley Memorial Hospital for $240,000 after 23 security guards were caught accessing patient medical records without authorization. The investigation started with a single complaint.

Banner Health paid $1.25 million in 2023 for a breach that exposed 2.81 million individuals' ePHI. Premera Blue Cross settled for $6.85 million in 2020 after a breach affecting over 10.4 million people. These cases are public record on the OCR Resolution Agreements page.

Every one of these started with someone deciding to report a HIPAA violation. That decision matters.

What Qualifies as a HIPAA Violation Worth Reporting?

This is the question I get most often. Not every annoyance is a HIPAA violation, and understanding the difference saves everyone time.

Reportable violations include:

  • Unauthorized access to medical records (snooping by employees, contractors, or others)
  • PHI disclosed to unauthorized individuals — verbally, electronically, or on paper
  • Failure to provide patients access to their own records within the required timeframe
  • Missing or inadequate safeguards for ePHI (no encryption, no access controls, no audit logs)
  • Lack of breach notification after a known incident
  • Retaliation against an employee who reported a compliance concern

Not HIPAA violations:

  • A rude receptionist (unpleasant, but not a privacy issue)
  • Your employer asking for a doctor's note (employers generally aren't covered entities)
  • A provider sharing your information with another provider for treatment purposes (this is permitted)

When in doubt, file the complaint. OCR will determine jurisdiction. You won't be penalized for a good-faith report that turns out to be outside HIPAA's scope.

The $240,000 Reason Unauthorized Access Is the #1 Complaint

Unauthorized access — employees looking at records they have no business viewing — consistently ranks as one of the most common HIPAA complaints OCR receives. The Yakima Valley case I mentioned isn't an outlier. It's a pattern.

Organizations that fail to train staff on the "minimum necessary" standard and fail to audit access logs are sitting on ticking time bombs. If your organization hasn't addressed this, our course Accessing Records: If It's Not Your Job, It's a Breach walks through exactly what constitutes unauthorized access and how to prevent it.

What Workforce Members Need to Know Before Filing

If you're a healthcare employee considering whether to report a HIPAA violation, I want to address your fears directly. Yes, it can feel risky. No, you shouldn't let that stop you.

HIPAA explicitly prohibits covered entities from retaliating against individuals who file complaints or participate in investigations. Section 160.316 of the Code of Federal Regulations spells this out. If your employer retaliates — termination, demotion, harassment — report that to OCR as well.

Document everything. Save emails. Note dates, times, and witnesses. If you reported internally and nothing happened, that documentation becomes powerful evidence in an OCR investigation.

The First Hour After You Witness a Breach

What you do in the first 60 minutes after witnessing or discovering a potential breach can shape the entire outcome. Secure the information if you can. Notify your Privacy Officer immediately. Don't discuss the incident on social media or in group chats — that creates additional exposure.

Our First 60 Minutes: Incident Response training covers this exact scenario in detail. It's built for the people on the ground who discover problems first.

Social Media: The Violation People Don't Realize They're Committing

I've investigated cases where employees posted photos of whiteboards with patient names visible. Cases where nurses discussed patient cases in closed Facebook groups, not realizing those groups had hundreds of members. Cases where a well-meaning staff member shared a patient's recovery story on Instagram without authorization.

Every one of those is a reportable HIPAA violation. If you've witnessed PHI being shared on social media — by a coworker, a provider, or a facility's official account — you can and should report it. Our Social Media & PHI training is specifically designed to address this growing risk area.

How Long Does an OCR Investigation Take?

Expect months, not weeks. OCR's caseload is substantial — they receive tens of thousands of complaints annually. Complex investigations involving large covered entities can stretch beyond a year.

That timeline isn't a reason to skip filing. OCR prioritizes cases involving willful neglect, large-scale breaches, and patterns of non-compliance. Even if your individual complaint doesn't result in a penalty, it may contribute to a pattern that triggers a broader investigation later.

Your Report Could Protect Thousands of Patients

Here's what I want you to take away from this. The entire HIPAA enforcement system depends on people being willing to report a HIPAA violation when they see one. OCR doesn't have the resources to proactively audit every covered entity in the country. Complaints are how they find the worst offenders.

That single complaint about Yakima Valley Memorial Hospital protected patients from ongoing unauthorized access. The complaints that led to the Banner Health investigation exposed systemic security failures affecting millions.

If you've witnessed a violation — as a patient, as an employee, as a family member — you have the tools and the legal right to act. File with OCR. Document what you saw. And if your organization needs better training to prevent these violations in the first place, explore the HIPAACertify course catalog for practical, scenario-based programs your workforce will actually remember.

Your report might be the one that changes everything.