HIPAA Policy Section 7.7: Right to Make A Complaint

System shall have a process by which an individual can make a complaint to the Privacy Officer regarding System’s compliance with the HIPAA Privacy Standards or any of the policies and procedures compiled in this Manual.

7.7(1) Responsibility for Receiving a Complaint

An Individual shall have the right to submit a complaint to System relating to System’s compliance with any of the policies and procedures compiled in this Manual and System’s compliance with the HIPAA Privacy Standards. The Privacy Officer or his/her designee shall be responsible for receiving and keeping a log of such complaints.

7.7(2) Filing a Complaint.

1. If an Individual or Personal Representative indicates the desire to make a complaint to System, the Privacy Officer shall ask the individual to submit a written complaint.
2. If the Individual agrees to submit a written complaint, the Individual shall complete System’s promulgated form. The Privacy Officer shall ensure that the complaint form completely states in clear terms the nature of the complaint and providing sufficient information to enable System to investigate, review, and resolve the complaint.
3. If the Individual declines to provide a written oral complaint, the Privacy Officer or her designee shall ask the Individual to explain the complaint in sufficient terms to enable the investigation, review, and resolution of the complaint, reduce the Individual’s complaint to writing and require the Individual to confirm the accuracy of the information that has been reduced to writing by the Privacy Officer by signing or verifying in the presence of a witness that the Individual agrees with the contents of the information.

7.7(3) Investigation of Privacy Complaints.

1. The Privacy Officer shall address and resolve all complaints, unless the complaint alleges a violation has been committed by the Privacy Officer, in which case the Chancellor shall designate another qualified individual to conduct the investigation. All such matters shall be privileged and confidential to the extent permitted by law. The Privacy Officer shall investigate and handle  as a quality review matter all complaints including, as appropriate, interviewing or otherwise contacting other persons involved in the circumstances upon which the complaint is based, and shall take all other steps necessary to review and investigate the complaint.
2. Following completion of the investigation, the Privacy Officer shall make a determination regarding whether a violation has occurred and if so whether (i) this Manual fails to comply with the HIPAA Privacy Standards; (ii) System has failed to comply with the policies and procedures compiled in this Manual; and/or (iii) System has failed to comply with the HIPAA Privacy Standards.

7.7(4) Correction of Discovered Privacy Violation.

If it is determined that any provision of the policies and procedures compiled in this Manual violates the law or otherwise needs modification, this Manual shall be revised in accordance with Section 9.1 of this Manual. If it is determined that System has violated either this Manual or the HIPAA Privacy Standards, such violation shall be corrected in accordance with Section 8.4 of this Manual, and if the violation is continuing, it shall be stopped. If the Privacy Officer determines that Workforce Members or other employees have violated the Manual or other System policies, the Privacy Officer shall refer the matter for Sanctions in compliance with Section 8.5 of this Manual and/or disciplinary action in accordance with System policy, as applicable.

7.7(5) Notice of Resolution of Privacy Complaints.

The Privacy Officer, may provide the complaining person with written notice of the decision regarding the complaint that includes (i) the name of the person handling the complaint; (ii) the fact that an investigation has taken place or will take place; (iii) the date of completion or expected completion; and (iv) either the result of the investigation or notification that due to the confidential and privileged nature of the peer review/quality review process, the results of such proceedings may not be communicated to the person. A copy of any such notice shall be retained in accordance with Section 9.2 of this Manual.

7.7(6) Document Retention.

System shall retain documentation of any complaint, including misdirected complaints, received, and its disposition. Such documentation shall be retained in accordance with Section 9.2 of this Manual.

7.7(7) Misdirected Complaints

Upon receipt of any complaint received by the Privacy Officer that alleges a violation by an entity other than System, the complaint shall be returned to the individual filing the complaint advising them that the complaint cannot be considered by System as it does not involve action by or on behalf of the System Hybrid Entity.

REFERENCES/CITATIONS

45 C.F.R. § 164.530(a), (d)