HIPAA Violation Complaint Letter
File a complaint about unauthorized disclosure of health information, denial of medical records access, or data breaches under HIPAA. Includes state health privacy laws with private rights of action.
Statute of Limitations Warning
Legal deadlines apply to your claim. You lose your right to act if you wait too long. Send notice as soon as possible.
Why this letter works:
- Cites the exact law: Automatically applies the correct state and federal statutes to your situation.
- Sets a firm deadline: Legally compels a response within the required statutory timeframe.
- Creates a paper trail: Designed to serve as Exhibit A if you need to escalate to an agency or court.
Answer a few questions and we'll create your personalized letter.
New here? Read the full guide on hipaa privacy rights first.
One-time price:$19Paid once at the end. No subscription.
Your Action Plan
This is the final formal demand before litigation.
Download your personalized PDF immediately after purchase and send it.
Your letter includes a firm deadline. Do not engage in informal text messages during this time.
If they miss the deadline, you have completed the required out-of-court steps. Hand this complete paper trail to a local attorney for litigation.
Your Situation
Tell us about the HIPAA violation so we can tailor your complaint letter.
This determines which state health privacy law applies in addition to federal HIPAA.
HIPAA applies to 'covered entities' (health plans, health care clearinghouses, and most health care providers) and their 'business associates.' If the entity is not a covered entity, your complaint may need to rely on state law instead.
Patients have the right to file complaints about their own PHI. Employees can also file complaints about violations they witness.
Select the primary type of violation. Your letter will cite the specific HIPAA rule that was violated.
Select all that apply. Most complaints involve the Privacy Rule. If electronic records were involved, the Security Rule may also apply.
Before you start
What exactly do I get, and when?
A personalized PDF letter, written around the statute that applies to your situation, with the deadline and the consequence spelled out. It downloads the moment payment confirms, back here on commoner-law.com — there is no waiting period and no account to create. You can also add certified mail at checkout and we will send the physical letter for you.
How much is it?
$19, once. Not a subscription, and nothing is charged until you complete payment on Stripe at the end of the wizard. Any add-ons you select show their own price before you pay.
Is this legal advice?
This tool creates a HIPAA violation complaint letter for self-help purposes. It is not legal advice and does not replace consultation with a licensed attorney. CRITICAL: HIPAA does not create a private right of action — you cannot sue under HIPAA directly. This complaint requests the HHS Office for Civil Rights to investigate and enforce. Filing an OCR complaint does NOT result in monetary compensation to you. Some states (California, Washington, Texas, and others) have health privacy laws that DO allow private lawsuits with damages — consult a health privacy attorney if you wish to pursue monetary recovery. You must file your OCR complaint within 180 days of discovering the violation. If your health information was used for identity theft, take immediate steps to protect your credit and financial accounts.
What if I need to change something afterwards?
Tell us and we will either adjust the letter and send you the updated version at no cost, or refund you in full — your choice. If we can’t deliver what you paid for, the refund is automatic. Full terms are on our promise page.
Do I have to pay to know if I have a case?
No. The rights encyclopedia on this site is free and cites the same primary sources the letter does. Read the relevant guide first — plenty of situations are resolved by a phone call to a free statutory body, and where one exists we say so.