Keep the breach notice. Secure exposed accounts before you start arguing about liability, then choose the complaint route that matches the organization and information involved. A complaint may create an official record or prompt corrective action, but it usually isn't a payment request.
Start with the notice. Read the facts once, then check the deadlines. Look for the organization named, the data categories, and any date for monitoring or submitting a claim.
This information is for U.S. consumers. State law, industry rules, and your location may change the route.
Identify the right complaint route
One incident may involve several rules. The right first stop depends on who held the data and what happened afterward.
Turns out, reporting possible noncompliance and seeking money are different jobs. A regulator may review the first issue; a bank or card issuer handles the second when unauthorized transactions are involved.
| Situation | First route | What to expect |
|---|---|---|
| Possible HIPAA violation | HHS Office for Civil Rights (OCR) | Administrative review of a covered entity or business associate |
| Possible Part 2 violation | HHS OCR | Review of confidentiality issues involving covered substance use disorder records |
| State breach-notification or privacy issue | The official state agency or court route named by that state's law | A state-specific review, enforcement action, or private claim if allowed |
| Unauthorized account activity | Your bank, card issuer, or payment provider | A fraud investigation and possible transaction remedy, separate from a privacy complaint |
| Need to see what a company holds | The company's privacy contact and any applicable access-request process | Records that the relevant privacy law requires the company to provide |
A breach letter reports the company's account of events. It doesn't, by itself, establish a HIPAA violation, state-law claim, contract breach, or right to sue.
Preserve evidence before you file
Make a small file another person can follow. Keep the originals, and send copies when you submit documents.
Write the timeline now. It beats searching through old statements later, especially if a company or regulator asks what happened.
- [ ] Save the breach letter, email headers, account messages, and any claim notice.
- [ ] Record when you received the notice and when you first saw suspicious activity.
- [ ] Note the information categories involved, such as credentials, medical records, or financial details.
- [ ] Keep credit reports, bank statements, fraud reports, replacement costs, and related correspondence.
- [ ] Draft a one-page timeline while the details are fresh.
- [ ] Remove unnecessary Social Security numbers, medical details, and account numbers before sending documents.
Save screenshots if the notice appears in a customer portal. Old portal messages can disappear.
Protect your accounts while the complaint moves
Lock down accounts first. Change reused passwords and enable multifactor authentication.
Contact the relevant bank, card issuer, or payment provider about unfamiliar transactions. If a Social Security number or similar identifier was exposed, consider a credit freeze or fraud alert.
Keep case numbers. Save call records, replacement-card costs, and other out-of-pocket expenses. Complaints create records, but they won't stop an active fraud attempt.
How to file a HIPAA complaint with HHS OCR
OCR is the route for possible HIPAA or Part 2 noncompliance. HHS says anyone can file a complaint about possible violations of the HIPAA Privacy, Security, or Breach Notification Rules or Part 2.
HIPAA generally covers health care providers, health plans, clearinghouses, and business associates. Part 2 applies to federally assisted substance use disorder treatment programs and other entities subject to that rule.
- Confirm the organization. Check whether the provider, plan, clearinghouse, business associate, or Part 2 organization falls under the rule involved.
- Mark the filing window. OCR generally expects a complaint within 180 days of when you knew, or should have known, about the violation. If you are late, explain why and ask whether OCR will accept an extension for good cause.
- Tell the story in order. Name the organization, give the relevant dates, describe what happened, and identify the records or information involved. Quote the breach notice when it helps.
- Attach focused evidence. Include notices, screenshots, letters, and response records. Redact information OCR doesn't need.
- Complete the consent and submit the complaint. Start with the HHS OCR complaint process or the OCR complaint portal. HHS also instructs people filing by email to send the completed complaint and consent forms to
[email protected]. Unencrypted email can expose personal information while it is being sent. - Save the confirmation. Keep the receipt and case number. OCR may ask for more information.
Mail is another option listed by HHS:
Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Building
Washington, DC 20201
OCR complaints are administrative. Filing one does not guarantee a personal payment.
A simple complaint outline
Keep the complaint factual. Attach only the records that help explain what happened.
Subject: HIPAA or Part 2 complaint - [organization]
I am complaining about [organization] regarding an incident on or about [date].
I learned about it on [date] through [notice, call, account message, or other source].
The information involved was [describe the categories of information].
The organization responded by [describe response or lack of response].
I believe these facts may involve [HIPAA rule or Part 2 issue].
I have attached [list the most useful documents].
Name:
Contact information:
Date:You don't need to prove the whole legal case in the first submission.
If HIPAA is not the right law
Health information alone doesn't make HIPAA apply. Coverage depends on the organization and its activity, not just on how sensitive the information is.
Outside HIPAA and Part 2, the route may depend on state law, the type of information, or the company's industry.
| Possible issue | Where to start | Limit to keep in mind |
|---|---|---|
| State breach-notification problem | The state attorney general or consumer-protection agency identified by state law | A notice violation and a private damages claim are not always the same thing |
| California security breach or privacy claim | The California statutory or court route that fits the facts | The CCPA and CPRA private right of action is limited to qualifying security incidents and legal conditions |
| Biometric, driver's-record, or other specially regulated data | The regulator or court route created by the relevant state or sector law | The statute may have specific definitions, deadlines, and proof requirements |
| Business privacy promise or access issue | The company's privacy office, followed by the applicable regulator | A privacy policy may support a complaint but does not guarantee damages |
California residents shouldn't assume every CCPA complaint supports a cash award. A regulator complaint and a private case are separate decisions.
The FTC's data breach response guide is written for businesses responding to incidents. It isn't a general consumer compensation portal.
Should you send a data access request?
An access request can fill gaps when a breach notice is vague. Use the company's privacy contact and ask for information that the applicable law gives you a right to receive.
You may also ask about the incident date, the data categories involved, and the steps the company took after discovery. Keep that request separate from the regulator complaint where possible.
Don't assume a 30-day GDPR response period applies to every U.S. request. Response periods vary by law and situation, and an access request usually does not extend a lawsuit deadline.
How compensation usually works
Thing is, enforcement money and consumer money are different buckets. A payment normally comes through a settlement, qualifying private claim, reimbursement program, or separate dispute over an unauthorized transaction.
| Route | Possible result | What to check |
|---|---|---|
| Regulator complaint | Investigation, correction, or enforcement | Whether the agency offers any redress program |
| Company reimbursement or claim program | Payment, monitoring, or expense reimbursement if offered | Eligibility rules, proof requirements, and the submission deadline |
| Individual lawsuit | Damages or settlement | Legal basis, injury, filing deadline, costs, and any required pre-suit notice |
| Class settlement | A share of a court-approved fund or other relief | The official notice, claim form, deadline, and release of future claims |
A breach notice alone doesn't guarantee money. Whether lost time, emotional harm, replacement costs, or other losses count depends on the law and the evidence.
Read the release before filing a settlement claim. Accepting payment may mean giving up related legal claims.
Deadlines that can affect your rights
Put each deadline on its own line. They rarely match.
| Action | Timing to verify | Why it matters |
|---|---|---|
| HIPAA complaint to OCR | Generally 180 days from when you knew or should have known | OCR may require an explanation and good-cause request for a late filing |
| Monitoring or settlement claim | The date printed in the official notice | Late claims are often rejected |
| Privacy or access request | The period under the specific state or federal law | A general U.S. deadline does not apply to every request |
| Private lawsuit | The limitation period under the applicable state law | An agency complaint may not pause that period |
| Unauthorized transaction report | Contact the institution immediately | Payment rules can depend on the transaction type and delay |
Check the notice, portal, and applicable law. Don't rely on a generic claim that data breach cases always have two, three, or six years.
Common mistakes to avoid
Small errors can send a complaint to the wrong place or cost you a deadline.
- Filing with OCR when the organization is not subject to HIPAA or Part 2.
- Treating a breach notification as proof that the company violated the law.
- Waiting for a regulator before reporting suspicious bank or card activity.
- Sending a complete medical file or account number when a redacted copy would work.
- Assuming a complaint automatically starts a lawsuit or preserves its deadline.
- Joining a settlement without checking the release and claim requirements.
To be honest, a provider's notice may name a vendor, insurer, or app, and that can make the recipient unclear. Identify who handled the information, who sent the notice, and which agency or court route fits the facts.
FAQ
Can I file a regulator complaint if I have no financial loss?
Often, yes. You can report possible noncompliance even when compensation is unavailable or no financial loss has occurred.
Can a HIPAA complaint make the company pay me?
Not by itself. OCR may review the conduct and seek corrective action, but a personal payment would normally require a separate redress program, settlement, or claim under an applicable law.
Is a breach notice enough to sue?
No. The notice may help show what the company reported, but a private case can also require a qualifying legal claim, evidence, and timely filing.
What if I missed the 180-day HIPAA deadline?
Explain the delay and request an extension for good cause through OCR's process. That deadline concerns the OCR complaint; a separate private claim can have a different deadline.
Put the breach notice, one-page timeline, and loss records in one folder today. Check the OCR window or any settlement deadline, submit to the route with jurisdiction, and save the confirmation.