Anyone can file a HIPAA privacy complaint with HHS, but I’m not confident this one will go anywhere if there is a signed business associate contract in place and the patient signed the privacy practices notice. I do think there needs to be an investigation on the Social Security number part of the complaint, though. See what you think.
The Office of Inadequate Security
