How to File a HIPAA Complaint

You may file a written complaint if you think a military treatment facility (MTF), Military Health System (MHS) component, or MHS business associate is violating the Health Insurance Portability and Accountability Act (HIPAA) Rules or the MHS Notice of Privacy Practices (NoPP).

You may file a complaint with: 

• Your local MTF’s HIPAA Privacy Office.
• The Defense Health Agency (DHA) Privacy and Civil Liberties Office (Privacy Office).
• The Department of Health and Human Services’ Office for Civil Rights. 

Filing a Complaint with the DHA Privacy Office

Please complete and mail the HIPAA Complaint Template to the below address:

Defense Health Agency
Privacy and Civil Liberties Office
7700 Arlington Boulevard, Suite 5101
Falls Church, VA 22041-5101

When filling out the template, please make sure your complaint: 

• States which DoD covered entity  (e.g, MTF, DHA etc.), or business associate you believe violated HIPAA or the NoPP;
• Includes as much detail as possible surrounding the violation (i.e., what happened, when it occurred, and who is the potential violator(s));
• Is filed within 180 days after you were made aware of the violation; and
• Is in paper form (electronic messages will not be accepted). 

HIPAA Prohibits Retaliation

HIPAA does not allow covered entities and business associates to punish you for filing a complaint. If you think you are being punished for filing a complaint, please notify your MTF’s HIPAA Privacy Officer or the DHA Privacy Office.