The Health Insurance Portability & Accountability Act (HIPAA) Rule allows you to file a health information privacy or security complaint. If you believe the County of Orange or its business associates violated your (or someone else’s) privacy or security rights, or committed another violation of the HIPAA Rule, you may file a complaint with the County of Orange Privacy Officer. The Privacy Officer and/or his/her designee receives and investigates complaints against County HIPAA designated covered programs.
Your complaint must: (1) Be filed in writing by mail, email or via the County of Orange HIPAA Complaint Website; (2) Name the covered entity or business associate involved (person, program or department) that is the subject of the complaint; (3) Describe the acts or omissions you believed violated the requirements of the Privacy, Security or Breach Notification Rule; (4) Be filed within 180 days of when you knew that the act or omission complained of occurred.
Under HIPAA, an entity cannot retaliate against you for filing a complaint. You should notify the County Privacy Officer immediately in the event of any retaliatory action.
How to File Complaints:
Option 1: Open and print out the HIPAA Complaint Form in PDF format (you will need Adobe Reader software to complete the forms). Return the completed complaint form to the address on the form by mail; or email the form to privacyofficer@ocgov.com.
Option 2: Fill out the HIPAA Complaint Form online at County of Orange HIPAA Complaint Website. Complete as much information as possible, including:
- Information about you, the complainant;
- Details of the complaint; and
- Any additional information that might help the County when reviewing your complaint.
Option 3: You may choose to contact the County Privacy Officer at (714) 834-4082 and request a complaint form be mailed to you. Return the completed complaint to the address on the form by mail.
Option 4: If you prefer, you may submit a written complaint in your own format. Be sure to include:
- Your name, full address; telephone numbers (include area code), email address (if available);
- The name, full address and telephone number (include area code) of the person, agency, department or program you believe violated your (or someone else’s) health information privacy or security rights, or committed another violation of the Privacy or Security Rule;
- Brief description of what happened. How, why and when do you believe your (or someone else’s) health information privacy rights were violated, or how the Privacy or Security Rule otherwise was violated;
- Any other relevant information, such as, if you have filed your complaint somewhere else; and
- Your signature and date of complaint.
If you are filing a complaint on someone’s behalf, also provide the name of the person on whose behalf you are filing. You may also include:
- If you need special accommodations for us to communicate with you about this complaint;
- Contact information for someone who can help us reach you if we cannot reach you directly; and
- If you have filed your complaint somewhere else and where you’ve filed.
BY MAIL - To submit complaint and consent forms via mail, please send to:
County of Orange – Privacy Officer
721 S. Parker St., 2nd Floor
Orange, CA 92868
BY E-MAIL - To submit complaint forms via email, please send to: privacyofficer@ocgov.com. (Email communication by unencrypted e-mail presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties.)
The County cannot investigate complaints without a name or contact information. Also, without enough details of the complaint, we may not have enough information to investigate. If you want the County to keep your name and contact information confidential during the investigation, you may specify on the complaint form. Please note the investigation may be delayed or impeded if your contact information cannot be disclosed.
Please note: Not all departments are required to comply with the HIPAA Privacy and Security Rules. The County of Orange can only investigate the designated covered components that is under the County Hybrid Entity. The County cannot investigate Privacy Rule complaints that occurred before April 24, 2003 because compliance with the Privacy Rule was not required until that date. Similarly, the County cannot investigate Security Rule complaints that occurred before April 20, 2005.
