NPP complaint and nonretaliation statement

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Both complaint destinations belong in the notice

Under 45 CFR 164.520, the notice includes the entity and Secretary routes, entity filing instructions, and nonretaliation statement. Identify the privacy office or contact and keep public HHS instructions current without imposing extra local prerequisites.

The entity route should explain where a complaint can be submitted and provide a usable contact. Support phone, writing, language, disability, and safe-communication needs through the actual process. A person does not need to complete an internal investigation before using the federal route. Keep the notice concise, then train intake staff to provide current HHS information when asked.

Build intake that preserves the concern

Accept a complaint even when the person uses ordinary language, the wrong form, or a general service channel. Record receipt time, complainant or representative, safe contact preference, allegation, affected entity, event date if known, immediate risk, owner, and related evidence. Collect only the information needed to assess and route the issue. Provide acknowledgment and expected next communication through an appropriate channel.

Use a triage process that recognizes privacy rights, access, breach, security, discrimination, billing, safety, workforce conduct, and clinical-quality concerns. One message may need coordinated review by several teams. Preserve a single accountable case while limiting each team's access to the information it needs. Avoid sending the person between departments merely because the first label was incomplete.

The workflow should protect the complainant

Log receipt, allegations, owner, response, investigation, corrective action, and closure. Restrict access and monitor for adverse actions. A complaint can reveal an access, breach, discrimination, billing, or clinical concern that needs parallel routing.

Nonretaliation requires more than a sentence in the notice. Train leaders and frontline staff that service, scheduling, billing, discharge, communication, and employment decisions cannot be used to punish a person for filing a privacy complaint. Use qualified review when an adverse action is independently proposed after a complaint. Record its supported basis and separate decision owner so the organization can evaluate whether retaliation risk is present.

Protect complaint information through role-based access and careful communications. Do not place unnecessary allegations in widely visible clinical notes or routine account comments. Preserve records, protect against deletion or alteration, and use a defined route for urgent threats, ongoing disclosure, or suspected evidence loss.

Investigate and close with a supported outcome

Define the issue, applicable notice and policy, evidence reviewed, interviews, findings, corrective action, response, and follow-up test. Closure can reflect substantiated, unsubstantiated, inconclusive, referred, or another policy-defined outcome. Do not use closure status to suppress a related breach assessment, rights deadline, or external-reporting duty.

Example with published channels

Seven notice and website channels are tested. Six reach monitored complaint intake; one fax number is disconnected. Route readiness is 6 of 7 channels.

The privacy office replaces the fax route across active notices, investigates messages that may have failed, and gives the channel a monitoring owner. It checks paper stock, websites, portals, translations, and voicemail scripts for the obsolete number. A follow-up test confirms receipt, timestamp, acknowledgment, and routing rather than stopping at a successful fax transmission.

Complaint-process checklist

• Publish both entity and HHS complaint options with current instructions.
• Accept concerns from ordinary channels and preserve the receipt date.
• Honor safe contact, language, disability, and representative needs.
• Triage privacy, rights, breach, security, and related concerns together.
• Restrict complaint information and preserve relevant evidence.
• Review possible adverse actions for retaliation risk.
• Document findings, response, corrective action, and follow-up testing.

Owner controls

HHS guidance describes complaint content. Use role-based contacts, tested channels, language access, nonretaliation training, escalation, retention, and periodic review. Report channel availability separately from resolution time.

Monitor intake availability, acknowledgment, aging, safe-contact adherence, parallel referrals, corrective actions, reopened concerns, and retaliation allegations. Audit from every published route into the case system and from complaint records back to the notice version and channel used. Share de-identified trends with governance owners so recurring notice, workflow, or training defects lead to measurable correction.

Set a continuity plan for privacy-office absence, channel outage, acquisition, and after-hours escalation. Manual intake should preserve the original time, safe route, allegation, and owner until the case system returns. Reconcile every manual record before closing the outage. Test whether frontline teams recognize a complaint that arrives through scheduling, billing, clinical, or executive channels and can transfer it without exposing the concern broadly.

Provide status communications that respect the complainant's contact preference and avoid promises about findings before review is complete. If another team owns part of the response, keep one coordinator responsible for the overall communication and retained evidence.