HIPAA GENERAL OPERATING POLICY #38
COMPLAINTS TO THE HCC
I. General
A HCC must provide a process for individuals to make complaints concerning its privacy policies and procedures or its compliance with such policies and procedures or the requirements of the Privacy Rule. A HCC must document all complaints received and their disposition, if any.
All complaints regarding the University’s HIPAA privacy policies and procedures and compliance with such policies and procedures, regardless of the form in which it was received, will be documented, reviewed, and acted upon, if necessary, by the University’s Privacy Official.
Documentation regarding complaints received and the resolution of such complaints will be retained, in written or electronic format, for at least six (6) years.
II. Procedure
Each HCC must develop and implement a process for receiving privacy complaints and reporting them to the University’s Privacy Official. Such process can be as simple as notifying employees that each individual submitting a privacy related complaint should be instructed to contact the University’s Privacy Official. The contact information for the University’s Privacy Official is located in General Operating Policy # 4. However, if a particular HCC would like to keep track of privacy complaints received for quality assurance purposes, the HCC can develop an alternative process, as long such process involves the notification of the University’s Privacy Official of each complaint received so that the Privacy Official can record and track the response to each complaint and can participate in the resolution of such complaints.
The Privacy Official will document each complaint received and maintain such documentation for at least six years. The Privacy Official will investigate each complaint, in conjunction with the applicable HCC and, if necessary, in conjunction with other affiliated entities, and will document the resolution of the investigation and any corrective actions taken.