How to report an infraction of the HIPAA requirements?
<p>In the United States, in accordance with <a href="https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act" rel="nofollow">HIPAA requirements</a>, the lab who performed a blood test on a patient are required to send the results to the patient no later than 30 days from the date of patient's request.</p>

<p>A patient requested multiple times their results (face-to-face during the blood test day, then by phone and emails). The lab eventually sent the patient the full results 3 months after the blood test, i.e. 3 months after first requested their results.</p>

<p>Where can the patient report this infraction of the HIPAA requirements?</p>

<p>If the answer is state-dependent, I'm mostly interested in California and Massachusetts.</p>

<hr>

<p><a href="https://myquest.questdiagnostics.com/web/help/Content/labresults.html" rel="nofollow">https://myquest.questdiagnostics.com/web/help/Content/labresults.html</a>:</p>

<blockquote>
  <p>The U.S. Department of Health and Human Services (HHS) ruling, effective April 7th, 2014, allows patients in all states to have access to their lab results directly from Quest Diagnostics within 30 days.</p>
</blockquote>

<p><a href="http://www.modernhealthcare.com/article/20140203/NEWS/302039958" rel="nofollow">http://www.modernhealthcare.com/article/20140203/NEWS/302039958</a></p>

<blockquote>
  <p>Under the new rule, labs will be required to provide patients copies of their lab test results within 30 days of a request. </p>
</blockquote>

<pre><code>Where can the patient report this infraction of the HIPAA requirements?
</code></pre>

<p>You file a complaint with the Office for Civil Rights (OCR).</p>

<blockquote>
  <p>If you believe that a covered entity or business associate violated
  your (or someone else’s) health information privacy rights or
  committed another violation of the Privacy, Security or Breach
  Notification Rules, you may file a complaint with OCR. OCR can
  investigate complaints against covered entities and their business
  associates.</p>
</blockquote>

<p>The U.S. Department of Health &amp; Human Services website for complaints is: <a href="http://www.hhs.gov/ocr/privacy/hipaa/complaints/" rel="nofollow noreferrer">http://www.hhs.gov/ocr/privacy/hipaa/complaints/</a>. From there you can file the complaint either electronically via the OCR Complaint Portal, or on paper by mail, fax, or e-mail.</p>

<p>The language from the Final Rule (<a href="https://www.federalregister.gov/articles/2014/02/06/2014-02280/clia-program-and-hipaa-privacy-rule-patients-access-to-test-reports#h-27" rel="nofollow noreferrer">CLIA Program and HIPAA Privacy Rule; Patients' Access to Test Reports</a>) that describes enforcement is section V part L:</p>

<blockquote>
  <p>Comment: Commenters asked whether a laboratory could be subject to
  penalties for charging more than the reasonable cost-based fee allowed
  by the Privacy Rule, for failing to comply with an individual's
  request for completed test reports within the appropriate time period,
  or for failing to comply with an individual's request altogether.</p>
  
  <p>Response: HIPAA-covered laboratories that fail to comply with the
  Privacy Rule's access provisions are subject to an enforcement action
  for noncompliance by the Department, which may include the imposition
  of civil money penalties.</p>
</blockquote>

<hr>

<p>Walkthrough to file a complain through the <a href="https://ocrportal.hhs.gov/" rel="nofollow noreferrer">OCR Complaint Portal</a> (which is linked on <a href="http://www.hhs.gov/ocr/privacy/hipaa/complaints/" rel="nofollow noreferrer">http://www.hhs.gov/ocr/privacy/hipaa/complaints/</a>), in the case mentioned in the question:</p>

<p><a href="https://i.stack.imgur.com/HbSLX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HbSLX.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/P1UFB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/P1UFB.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/QC4qC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QC4qC.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/GmknU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GmknU.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/7qXDR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7qXDR.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/QQNij.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QQNij.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/FFdwD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FFdwD.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/KQKS6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KQKS6.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/NY6FJ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/NY6FJ.png" alt="enter image description here"></a></p>

<p><a href="https://i.stack.imgur.com/TskJG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/TskJG.png" alt="enter image description here"></a></p>

<p>Done!</p>

united-states health data-ownership