Paul has heart surgery. While he's recovering, staff is constantly distracted by their phones and fails to check in on him at required intervals, administer medication on time, and provide medically recommended therapy.

Before he checks out, Paul sees that the hospital's website has a form for making a complaint to hospital administration. Paul fills it out and notes all the information above.

The hospital's CEO reads the form, disciplines all the staff identified, and takes no further action with it.

To what extent is the form covered by HIPAA's Privacy Rule?

I'm looking for answers supported by law addressing similar facts.

1 Answer 1


PHI is health information that is individually identifiable. Any record, even a post-it note, can be PHI.

In this case, the complaint form is PHI if it contains the patient's name or other identifier along with the details of treatment.

When PHI is held by a covered entity, including the hospital CEO, it is protected by HIPAA privacy regulations.

  • But is the complaint form "health information"? Is the context in which the information relayed relevant? In other words, does it matter that Paul disclosed this information to complain about a business transaction with the hospital, as opposed to disclosing it for the purposes of obtaining medical treatment?
    – bdb484
    Jul 9, 2023 at 11:23
  • It's health information if it contains details of treatment. The reason for recording the information is irrelevant.
    – FlowVoid
    Jul 9, 2023 at 15:42
  • Are you able to point to any law supporting this interpretation?
    – bdb484
    Jul 10, 2023 at 16:17
  • @bdb484 Assuming the complaint contained PHI, the Privacy Rules contain numerous provisions for authorizing further disclosure related to handling complaints. See, e.g., 45 CFR s. § 164.512 "Uses and disclosures for which an authorization or opportunity to agree or object is not required," particularly, (d) "Standard: Uses and disclosures for health oversight activities."
    – Upnorth
    Jul 10, 2023 at 16:36
  • @bdb484 Per 45 CFR 160.103 *Health information means any information … whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider … ; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. *Individually identifiable health information is information that is a subset of health information, including demographic information … [edited for space]
    – FlowVoid
    Jul 11, 2023 at 0:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .