How to File a HIPAA Privacy Complaint About ABA Services

Check whether OCR can review the subject

The HHS complaint page says OCR can investigate HIPAA complaints against covered entities and business associates. Not every ABA provider, app, family member or other recipient falls within that scope. Name the legal entity or vendor, location, contact information and relationship to the PHI.

Describe whether the concern involves access, use, disclosure, security, breach notification or another HIPAA duty. Keep Part 2, state privacy, consumer-health, licensing and contract questions separate.

Protect the 180-day filing period

HHS's current complaint-process page says the complaint must be in writing, name the involved entity, describe the acts or omissions, and be filed within 180 days of when the person knew of them. OCR may extend the period for good cause.

Record the event date, discovery date, last related act, filing target and evidence source. Do not wait for an internal process to finish unless a current authority confirms how it affects the federal clock.

Choose a secure filing method

OCR lists its complaint portal, mail, fax and email routes. HHS warns that unencrypted email creates interception risk for personally identifiable information. Use the route that fits the information and accessibility needs, attach only relevant records, and keep the exact filed version.

Review the consent form and confidentiality choices. A family member's ability to submit information is distinct from legal authority to exercise another person's privacy rights.

Track nonretaliation and other outcomes

HHS states that HIPAA and Part 2 prohibit retaliation for filing a complaint and asks people to notify OCR of retaliatory action. Apply that protection within its actual scope and document any new event with dates and source evidence.

OCR review does not automatically correct a clinical record, restore portal access, pay a claim, award damages or decide state-law rights. Keep immediate safety, provider response and legal advice on their own tracks.

Questions to answer before filing or closing

Use the OCR privacy-complaint register to route each question to the provider, qualified clinician, BACB, state board, payer, HHS OCR, DOJ, OIG, consumer office, advocate, lawyer, client or family member with authority to answer it. Bring the current policy, form, notice, record, claim, EOB, message, receipt or case letter:

• Which entity or business associate is involved?
• What act or omission occurred?
• When was it discovered?
• Which HIPAA or Part 2 route applies?
• Which filing method protects the information?
• What does the consent form permit?
• Which safety, retaliation or state-law route remains separate?

Mark each answer confirmed, open, disputed or decided. Record what its source proves, the version and effective date, owner, next action, deadline and client view. Keep OCR jurisdiction, filing completeness, investigation, HIPAA finding, provider correction, state-law claim and legal remedy distinct. When sources conflict, preserve both and seek written clarification from the authority that governs the disputed step.

Before sending or accepting anything, run a final route check for the OCR privacy-complaint register. Confirm the receiving office, eligible subject, current form, signature or consent, attachment format, secure delivery method, deadline, requested remedy, and contact for accessibility or technical help. Record any unavailable item and the fallback authorized by the receiving office. This check reduces avoidable rejection while keeping substantive judgment with the decision-maker.

Complete immediate safety and mandatory action first. File or close only through the route whose requirements and consequences the client or authorized person understands.

Maintain an OCR privacy-complaint register

Client priorities, complainant, subject entity or business associate, HIPAA or Part 2 route, act or omission, event and discovery dates, 180-day target, good-cause facts, source evidence, privacy minimization, filing method, consent form, accessibility, submission, receipt, OCR contact, nonretaliation concern, parallel routes, owners, and dates belong in one current, role-limited OCR privacy-complaint register. Preserve originals and add later events as new entries. Label direct observation, client report, family report, provider record, payer evidence, authority response and interpretation as different sources.

Give the client an accessible summary and invite corrections. Store health, identity, financial and third-party information only where the selected route requires it. The OCR privacy-complaint register should expose missing evidence, unsafe delay and every deadline rather than burying them in a narrative.

Plan for a foreseeable process failure

Prepare a response to wrong legal entity, noncovered subject, uncertain discovery date, approaching deadline, insecure email, inaccessible portal, overbroad attachment, missing consent choice, new retaliation concern, urgent safety event, or a state privacy deadline. Name who protects immediate health and safety, who communicates with the client, which record must be preserved, and which provider, clinician, payer, regulator, advocate, law-enforcement or emergency role must act.

Keep AAC, communication, food, water, bathroom use, medication, mobility and emergency help available. Record the event, actual response, temporary safeguard, missing evidence and safe continuation condition. A complaint process cannot supply medical, emergency or protective action outside its authority.

A fictional OCR filing review

Rosa locks 14 filing conditions. Ten are ready. The business-associate identity, discovery-date support, accessible consent form, and state-law deadline remain open. Readiness is 10 of 14, or 71.4%.

The ratio does not establish a HIPAA violation, OCR jurisdiction, good cause, confidentiality, investigation, retaliation, or a remedy.

Measure the named process

Define the OCR privacy-complaint register cohort before counting. Report verified items divided by all items due at the same checkpoint. Keep missing, failed and disputed items in the denominator, with age, consequence and owner. Record an inapplicable item only when the governing source and facts support that classification.

Focus on Rosa's account, correct entity, federal clock, secure and accessible filing, consent choice, evidence minimization, nonretaliation, safety, parallel deadlines, and burden. Pair process counts with the client's direct report and any material clinical, access, privacy, payer, financial or safety outcome. A completion percentage does not establish jurisdiction, truth, causation, legal compliance, satisfaction or future protection.

Set the next review while the file is open

Review the OCR privacy-complaint register when the privacy concern is discovered, before sending attachments, before the 180-day target, after filing, after each OCR contact, and whenever a new event or parallel deadline arises. Close each row as filed, acknowledged, corrected, refunded, referred, withdrawn, declined, appealed, escalated, completed or finally decided. Keep the source, decision-maker, rationale, date and evidence.

At review, ask what the process misunderstood and whether the client wants the requested remedy changed. One named owner remains accountable for every open item, including work assigned to another organization.