How to report an infraction of the HIPAA requirements?

Question

In the United States, in accordance with HIPAA requirements, the lab who performed a blood test on a patient are required to send the results to the patient no later than 30 days from the date of patient's request.

A patient requested multiple times their results (face-to-face during the blood test day, then by phone and emails). The lab eventually sent the patient the full results 3 months after the blood test, i.e. 3 months after first requested their results.

Where can the patient report this infraction of the HIPAA requirements?

If the answer is state-dependent, I'm mostly interested in California and Massachusetts.

---

https://myquest.questdiagnostics.com/web/help/Content/labresults.html:

The U.S. Department of Health and Human Services (HHS) ruling, effective April 7th, 2014, allows patients in all states to have access to their lab results directly from Quest Diagnostics within 30 days.

http://www.modernhealthcare.com/article/20140203/NEWS/302039958

Under the new rule, labs will be required to provide patients copies of their lab test results within 30 days of a request.

Answer 1

Where can the patient report this infraction of the HIPAA requirements?

You file a complaint with the Office for Civil Rights (OCR).

If you believe that a covered entity or business associate violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security or Breach Notification Rules, you may file a complaint with OCR. OCR can investigate complaints against covered entities and their business associates.

The U.S. Department of Health & Human Services website for complaints is: http://www.hhs.gov/ocr/privacy/hipaa/complaints/. From there you can file the complaint either electronically via the OCR Complaint Portal, or on paper by mail, fax, or e-mail.

The language from the Final Rule (CLIA Program and HIPAA Privacy Rule; Patients' Access to Test Reports) that describes enforcement is section V part L:

Comment: Commenters asked whether a laboratory could be subject to penalties for charging more than the reasonable cost-based fee allowed by the Privacy Rule, for failing to comply with an individual's request for completed test reports within the appropriate time period, or for failing to comply with an individual's request altogether.

Response: HIPAA-covered laboratories that fail to comply with the Privacy Rule's access provisions are subject to an enforcement action for noncompliance by the Department, which may include the imposition of civil money penalties.

---

Walkthrough to file a complain through the OCR Complaint Portal (which is linked on http://www.hhs.gov/ocr/privacy/hipaa/complaints/), in the case mentioned in the question:

Done!