How to File a Patient Safety Confidentiality Complaint

About Patient Safety Confidentiality

OCR enforces the confidentiality provisions of the Patient Safety and Quality Improvement Act of 2005 (Patient Safety Act) and the Patient Safety and Quality Improvement Rule (Patient Safety Rule). Together, the Patient Safety Act and Rule establish a voluntary system for Patient Safety Organizations (PSOs) to collect and analyze medical error and patient safety event data. To encourage provider reporting, the Patient Safety Act and Rule include Federal privilege and confidentiality protections for patient safety work products (PSWP). Information submitted to, and developed by, these PSOs is protected as PSWP. 

What is PSWP?

PSWP is any information:

  • Assembled or developed by a health care provider for reporting to a Patient Safety Organization (PSO) that is listed by the HHS Agency for Healthcare Research and Quality (AHRQ) and is documented as being within the provider’s patient safety evaluation system for reporting to a PSO
  • Developed by a PSO for the conduct of patient safety activities
  • Identifies or constitutes the deliberations, or analysis of, or identifies the fact of reporting pursuant to a patient safety evaluation system

PSWP may identify patients, health care providers and individuals that report medical errors or other patient safety events.  This PSWP is confidential and may only be disclosed in certain very limited situations.  

Complaint Requirements

Anyone can file a patient safety confidentiality complaint. If you believe that a person or organization shared PSWP, you may file a complaint with OCR.  Your complaint must:

  • Be filed in writing: sent by mail, fax or e-mail 
  • Name the person that is the subject of the complaint and describe the act or acts believed to be in violation of the Patient Safety Act requirement to keep PSWP confidential
  • Be filed within 180 days of when you knew or should have known that the act complained of occurred, however OCR may waive the 180-day time limit for “good cause" shown

File a Patient Safety Confidentiality Complaint

File a Complaint Using the Patient Safety Confidentiality Complaint Form Package

Open and fill out the Patient Safety Confidentiality Complaint Form and Consent Form Package in PDF format. You will need Adobe Reader software to fill out the complaint and consent forms. You may either:

  • Print and mail or fax the completed complaint and consent forms to the appropriate OCR regional office
  • Email the completed complaint and consent forms to [email protected] (Please note that communication by unencrypted email presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties)

File a Complaint Without Using Our Patient Safety Confidentiality Complaint Package

If you prefer, you may submit a written complaint in your own format by either:

Be sure to include:

  • Your name
  • Full address
  • Telephone numbers (include area code)
  • E-mail address (if available)
  • Name, full address and telephone number of the person, agency, or organization you believe violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy or Security Rule
  • Brief description of what happened, including how, why, and when you believe a person impermissibly disclosed patient safety work product  
  • Any other relevant information
  • Your signature and date of complaint

You may also include:

  • If you need special accommodations for us to communicate with you about this complaint
  • Contact information for someone who can help us reach you if we cannot reach you directly
  • If you have filed your complaint somewhere else and where you’ve filed

How OCR Investigates Your Complaint

OCR will investigate complaints that allege potential violations of the Rule. To the extent practicable, OCR will provide technical assistance and seek informal resolution of complaints involving the inappropriate sharing of PSWP through voluntary compliance from the responsible person, entity, or organization. When OCR is unable to achieve an informal resolution of an indicated violation through such voluntary compliance, the Secretary may impose a CMP of up to $11,000 for each knowing and reckless disclosure of PSWP that is in violation of the confidentiality provisions.

Content created by Office for Civil Rights (OCR)
Content last reviewed