HIPAA GENERAL OPERATING POLICY #35
REFRAINING FROM INTIMIDATION OR RETALIATORY ACTS
A HCC may not intimidate, threaten, coerce, discriminate against, or take retaliatory action against:
a. Any individual for the exercise by the individual of any right under, or for participation by the individual in any process established under the Privacy Rule, including the filing of a complaint.
b. Any individual or other person:
i. Filing a complaint with the Secretary of DHHS;
ii. Testifying, assisting, or participating in an investigation, compliance review or hearing; or
iii. Opposing any act or practice made unlawful by the Privacy Rule, provided the person has a good faith belief that the practice opposed is unlawful, and the manner of the opposition is reasonable and does not involve disclosure of PHI in violation of the regulations.