How to File a Healthcare Complaint: Agencies, Processes, and Tips

Filing a healthcare complaint is one of the most concrete tools patients have when something goes wrong — and something goes wrong more often than most people realize. This page covers which agencies handle which types of complaints, how the intake and investigation process typically unfolds, and where the lines are between different oversight systems. Understanding the landscape before filing makes a meaningful difference in whether a complaint reaches the right desk.

Definition and scope

A healthcare complaint, in the regulatory sense, is a formal allegation submitted to an oversight body asserting that a provider, facility, or health plan has violated a law, standard, or patient right. That definition covers an enormous range of situations — from a hospital that discharged a Medicare patient too early, to a physician who billed for a procedure that never happened, to a nursing home where call lights go unanswered for hours.

The scope of who can file is broad. Patients, family members, patient representatives, and in most cases even anonymous third parties can submit complaints. The scope of what gets reviewed, however, depends entirely on which agency receives it. Federal agencies handle federal law violations. State agencies handle licensure and state-law matters. The two systems run in parallel and sometimes overlap, which is exactly as confusing as it sounds — but navigable once the map is clear.

For a broader orientation on the landscape of patient rights and oversight, the patient advocacy overview lays out the foundational framework that complaints plug into.

How it works

Most complaints follow a recognizable sequence, regardless of the agency involved:

1. Submission — The complainant submits a written complaint, either through an online portal, a paper form, or in some cases a phone call that is then documented. The Centers for Medicare & Medicaid Services (CMS), for example, accepts complaints about Medicare-certified facilities through its QualityNet complaint intake system and routes them to State Survey Agencies for investigation.

2. Intake and triage — The agency determines whether the complaint falls within its jurisdiction and whether the allegation, if true, would constitute a violation. Complaints that don't meet the threshold for a regulatory violation are typically closed at intake with a letter to the complainant.

3. Investigation — For complaints that proceed, investigators review medical records, interview staff, and in facility complaints, may conduct unannounced on-site surveys. The Office for Civil Rights (OCR) at HHS, which handles HIPAA privacy complaints, completed investigations of over 34,000 complaints in fiscal year 2022.

4. Resolution — Outcomes range from a finding of no violation, to a corrective action plan, to civil monetary penalties, to referral for criminal prosecution. Providers found in violation of HIPAA face civil penalties ranging from $100 to $50,000 per violation, with an annual cap of $1.9 million per violation category (HHS HIPAA Enforcement Rule, 45 CFR §160.404).

5. Notification — Federal and state agencies typically notify the complainant of the outcome, though the level of detail varies. HIPAA complaints, for instance, may result in limited disclosure to protect the investigation.

The full mechanics of how oversight bodies function are explored in how patient advocacy works.

Common scenarios

Three situations account for a large share of healthcare complaints filed annually.

Billing fraud and improper charges — Complaints involving upcoding, phantom billing, or balance billing beyond what a plan allows go to the Office of Inspector General (OIG) at HHS, state insurance commissioners, or both. The OIG's fraud hotline receives over 100,000 contacts per year (HHS OIG Annual Report).

Quality of care in Medicare/Medicaid facilities — A hospital, nursing home, or home health agency that falls below CMS Conditions of Participation is reported to the relevant State Survey Agency. These are the investigators who show up unannounced with clipboards. Nursing home complaints specifically can also go to the Long-Term Care Ombudsman program, a federally mandated network operating in all 50 states under the Older Americans Act.

Privacy violations — Unauthorized disclosure of protected health information, denied access to one's own medical records, and improper use of health data are HIPAA matters filed with HHS OCR. The HHS OCR complaint portal accepts submissions online and requires filing within 180 days of the date the complainant knew or should have known of the violation.

For people uncertain which category their situation falls into, how to get help with patient advocacy walks through the process of identifying the right channel.

Decision boundaries

Not every bad healthcare experience is a regulatory complaint. The distinction matters because filing with the wrong body — or expecting a regulatory agency to do something outside its authority — wastes time and, worse, can leave the real issue unaddressed.

Regulatory complaints vs. civil litigation — Agencies investigate violations of law and impose regulatory consequences. They do not award damages to individual patients. A patient harmed by malpractice needs a civil attorney, not a CMS complaint form. The two paths are not mutually exclusive — filing a regulatory complaint and pursuing civil litigation simultaneously is legal and sometimes strategically sound — but they accomplish different things.

State licensing boards vs. federal agencies — A physician's license is issued by a state medical board, not a federal agency. Complaints about a physician's clinical conduct, professional behavior, or fitness to practice go to the state board. CMS jurisdiction applies to facilities and to Medicare/Medicaid program participation — not to individual licensure. The key dimensions of patient advocacy page maps out how these oversight layers relate to each other.

Grievances vs. external complaints — Health plans are required under the ACA to have internal grievance processes. Exhausting the internal grievance process is often a prerequisite before an external complaint to a state insurance commissioner or CMS will be investigated. Skipping the internal step doesn't disqualify a complaint in every case, but it can slow or complicate the external review. The patient advocacy FAQ addresses common questions about when to escalate beyond a plan's own process.