If you believe you PHI has been used or disclosed in violation of the Privacy Rule you can
File a complaint
Due the covered entity
Sue the federal government
1 answer
for violations of the Privacy Rule, contact the Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services. You can file a complaint with the OCR online, by mail, or by fax. The OCR will investigate your complaint and take action if it finds that there has been a violation of the Privacy Rule. If necessary, you may also have the option to file a lawsuit against the covered entity that violated your privacy rights.