Because of the increased criminal prosecution and civil enforcement of HIPAA violations encouraged by the HITECH Act, handling patient HIPAA complaints properly has become even more important. I always tell my HIPAA seminar attendees and HIPAA consulting clients that I would never discourage an internal complaint. In fact, I would actively encourage complaints. Often, if you know about a patient complaint, you can resolve it without it mushrooming into a much bigger problem, especially if the patient complains to the Office of Civil Rights (“OCR”) of the Department of Health & Human Services (“DHHS”). Even if you haven’t violated HIPAA, responding to the OCR investigation of a complaint is a major hassle. It is much easier to investigate the internal complaint and try to resolve it than it is to respond to an OCR investigation. Further, not having the required complaint procedure would seem to constitute willful neglect, which carries the highest civil money penalties. Consequently, I wrote a new Sample Complaint Procedure with both a short and a longer Sample HIPAA Privacy Complaint Form for the Premium Member section of this website. These three documents should be available shortly. Adapting the procedure, along with one of the sample forms, to your situation and following it should go a long way toward handling complaints properly and thereby minimizing the risk of adverse outcomes from complaints.