HIPAA violations are reported anonymously by using an organization’s anonymous compliance reporting channel when available and, for external reporting to the HHS Office for Civil Rights, by submitting a complaint with contact information provided to the agency while requesting that the agency not disclose the complainant’s identity to the organization, since the OCR complaint process typically requires contact details and a fully anonymous submission can prevent the agency from obtaining follow-up information needed to proceed. Anonymous reporting is a workplace reporting method rather than a guarantee that no identifying information can be inferred from the facts provided.
For internal reporting, follow the process described in the Notice of Privacy Practices, compliance hotline guidance, human resources policies, or the compliance reporting portal, and use the anonymous option if offered. Report the facts with dates, locations, system names, record types, and the names or roles of involved workforce members when known. Exclude patient identifiers that are not necessary to describe the event, and include enough operational detail for the organization to identify the affected workflow, system, or department.
For external reporting to the HHS Office for Civil Rights, use the OCR Complaint Portal or submit a written complaint to OCR and include the covered entity or business associate name, a description of what occurred, and the time frame of the suspected violation. Use a confidentiality request if the concern involves workplace risk, and provide a method for OCR to contact the complainant for clarification. A complaint submitted without contact information may not be actionable because OCR may be unable to verify facts, request records, or confirm jurisdiction and timeliness.
After submission, retain a copy of the complaint, supporting documents, and any confirmation of receipt, and document any subsequent communication with the organization or OCR. HIPAA includes protections against retaliation for filing a complaint with OCR, and retaliation allegations are separately reportable to OCR using the same complaint process.