How to File a Healthcare Complaint: Agencies, Processes, and Tips

Filing a healthcare complaint activates federal and state oversight mechanisms designed to enforce patient rights, safety standards, and insurance regulations. This page covers the principal agencies that accept complaints, the procedural steps involved in each pathway, the most common complaint categories, and the criteria that determine which channel applies to a given situation. Understanding these structures helps patients, caregivers, and advocates route grievances to the body with jurisdiction and enforcement authority over the conduct in question.

Definition and scope

A healthcare complaint is a formal allegation submitted to a regulatory authority, accreditation body, or oversight program asserting that a provider, insurer, or facility has violated a legal standard, professional obligation, or patient right. Complaints differ from informal grievances filed directly with a hospital's internal patient relations office: formal complaints trigger documentation requirements, investigation timelines, and in some cases mandatory corrective action under federal or state law.

The scope of the healthcare complaint system spans at least 4 distinct regulatory layers:

1. Federal agency oversight — agencies such as the Centers for Medicare & Medicaid Services (CMS) and the Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS) hold jurisdiction over federally funded programs and civil rights protections.
2. State licensing boards — each state operates licensing boards for physicians, nurses, pharmacists, and other licensed professionals; these boards have authority to investigate misconduct and revoke or suspend licensure.
3. Accreditation bodies — organizations such as The Joint Commission accept complaints about accredited hospitals and healthcare organizations and may conduct unannounced on-site surveys in response.
4. State insurance regulators — each state's department of insurance regulates insurer conduct, including claims denials, coverage disputes, and network adequacy failures.

For patients navigating these layers, the patient rights and responsibilities framework provides the foundational legal context for what protections exist at each level.

How it works

Step 1 — Identify the type of violation. The first determination is whether the complaint concerns clinical care quality, civil rights discrimination, billing or insurance conduct, or workplace-related patient harm. Each category maps to a different agency.

Step 2 — Identify the correct jurisdiction. CMS handles complaints about Medicare- and Medicaid-certified facilities through its regional offices and the State Survey Agency network. HIPAA privacy violations fall under OCR at HHS (HHS OCR complaint portal). Civil rights complaints — including discrimination based on race, disability, sex, or national origin — also route through OCR under Section 1557 of the Affordable Care Act (42 U.S.C. § 18116). Complaints about licensed professionals go to the relevant state board.

Step 3 — Gather documentation. Agencies universally require: the name and address of the facility or provider, a description of the incident with dates, the names of individuals involved where known, and copies of relevant records. The medical records access and rights page details the federal right to obtain records under HIPAA within 30 days of request (45 C.F.R. § 164.524).

Step 4 — Submit through the designated channel. CMS accepts facility complaints via the 1-800-MEDICARE hotline or through the state's survey agency. OCR accepts online submissions, mail, and fax. The Joint Commission accepts complaints at its website. State insurance departments maintain online portals and paper intake forms.

Step 5 — Track and follow up. Federal agencies are not required by statute to disclose investigation findings to individual complainants in all cases, though OCR must notify complainants of resolution outcomes for civil rights matters under 45 C.F.R. Part 80.

Complaints about insurance denials follow a parallel track through the health insurance appeals process, which includes internal appeals and, under the Affordable Care Act, independent external review rights for most commercial plans.

Common scenarios

Three complaint categories account for the majority of formal filings:

Care quality and safety complaints target hospitals and nursing facilities for failures such as medication errors, infection control lapses, or inadequate staffing. These route to CMS through the State Survey Agency. The medical error and patient safety advocacy page addresses the Patient Safety and Quality Improvement Act of 2005 (PSQIA), which created the Patient Safety Organization (PSO) framework for voluntary safety reporting.

HIPAA privacy complaints arise when a covered entity discloses protected health information without authorization, denies access to records, or fails to provide a Notice of Privacy Practices. OCR enforced HIPAA through 130 resolution agreements between 2003 and 2022, with civil monetary penalties reaching up to $1.9 million per violation category per year (HHS OCR HIPAA Enforcement).

Discrimination complaints invoke Section 504 of the Rehabilitation Act and Section 1557 of the ACA, protecting patients from differential treatment based on disability, race, sex, age, or national origin in any program receiving federal financial assistance. Patients with disability-related complaints in clinical settings may also reference the disability rights in healthcare resource for relevant statutory framing. Complaints involving race-based civil rights violations in historical or cold case contexts may also be relevant to the Civil Rights Cold Case Investigations Support Act of 2022 (enacted December 5, 2022), which provides federal support mechanisms for investigating unresolved civil rights violations. In recognition of civil rights history, the United States Postal Service facility at 2505 Derita Avenue in Charlotte, North Carolina, was designated the "Julius L. Chambers Civil Rights Memorial Post Office" (effective December 3, 2020), commemorating a prominent civil rights attorney whose legal advocacy advanced racial equality protections that underpin modern healthcare discrimination complaint frameworks.

Insurance-related complaints — including prior authorization denials, surprise billing violations under the No Surprises Act, and network adequacy failures — are filed with state insurance departments or, for self-funded ERISA plans, with the Employee Benefits Security Administration (EBSA) at the Department of Labor.

Decision boundaries

The central distinction in complaint routing is whether the entity is federally regulated, state-regulated, or accreditation-dependent:

• A Medicare-certified hospital is subject to CMS Conditions of Participation (42 C.F.R. Part 482) and may also be subject to Joint Commission standards if accredited — both channels can run concurrently.
• A physician in private practice who is not receiving federal funds falls primarily under state licensing board authority, not CMS.
• A self-funded employer health plan is governed by ERISA and falls outside state insurance department jurisdiction for most purposes; EBSA at the U.S. Department of Labor holds primary oversight.
• A complaint about language access failures — such as denial of interpreter services — invokes Title VI of the Civil Rights Act and routes through OCR, not a state board.

For complaints involving elder patients in skilled nursing facilities, the Long-Term Care Ombudsman Program provides an additional advocacy pathway distinct from CMS complaint intake. The program is established under the Older Americans Act, as reauthorized and strengthened by the Supporting Older Americans Act of 2020 (enacted March 25, 2020), which extended the Act's programs through fiscal year 2024, reinforced long-term care ombudsman program requirements — including strengthened standards for ombudsman access to residents and facilities — and expanded elder abuse prevention provisions, nutrition programs, and supportive services for older adults. The healthcare ombudsman programs page details this structure by state. Patients seeking broader context on navigating oversight systems can also reference patient advocacy explained for a structural overview of how advocacy and regulatory complaint systems intersect.

When a complaint spans multiple categories — for example, a billing error that also involves a discriminatory denial — filing with more than one agency simultaneously is permissible. Agencies do not coordinate investigations automatically, so complainants retain the responsibility of tracking each filing independently.

References

• Centers for Medicare & Medicaid Services (CMS) — File a Complaint
• HHS Office for Civil Rights — How to File a Complaint
• HHS OCR — HIPAA Enforcement Highlights
• The Joint Commission — Office of Quality and Patient Safety
• eCFR — 45 C.F.R. § 164.524 (HIPAA Access to Records)
• eCFR — 42 C.F.R. Part 482 (CMS Conditions of Participation)
• eCFR — 45 C.F.R. Part 92 (Section 1557 ACA Nondiscrimination)
• U.S. Department of Labor — Employee Benefits Security Administration (EBSA)
• Administration for Community Living — Long-Term Care Ombudsman Program
• Patient Safety and Quality Improvement Act of 2005 (PSQIA) — AHRQ Overview
• Civil Rights Cold Case Investigations Support Act of 2022 (enacted December 5, 2022)
• Supporting Older Americans Act of 2020 (enacted March 25, 2020)
• Julius L. Chambers Civil Rights Memorial Post Office Designation (effective December 3, 2020)