Patient Complaint Form Template
A complaint form patients can fill in themselves, plus an office-use section that records who investigated, what you found, and when you responded. HIPAA requires a complaint process and a record of each complaint and its outcome; this form covers both.
The top half is for the patient; the office-use section records how you resolved it. Edit the practice details, then print blank copies or fill one in on screen while taking a phone complaint.
Patient Complaint Form
You will not be treated differently for filing a complaint
1.Your information
2.What is the complaint about?
3.Tell us what happened
Your signature (optional)
Date
4.Office use: investigation
Complete for every complaint. Privacy complaints go to the privacy officer the same day.
5.Office use: resolution
Closed by (privacy officer or manager)
Date
You may also file a privacy complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, generally within 180 days of when you knew of the problem. We will not retaliate against you for filing a complaint with us or with HHS.
Do Medical Practices Need a Patient Complaint Process?
For privacy complaints, yes. The HIPAA Privacy Rule requires every covered entity to “provide a process for individuals to make complaints” about its privacy policies and its compliance with them, and to document every complaint received and its disposition (45 CFR 164.530(d)). Your Notice of Privacy Practices must also tell patients they can complain to you and to HHS, briefly describe how to file with you, and promise no retaliation (45 CFR 164.520(b)(1)(vi)).
A single form that covers privacy and everything else (billing, wait times, how someone was treated) is simpler for patients and staff. Privacy complaints then get routed to the privacy officer while the rest go to the practice manager.
The No-Retaliation Rule
A covered entity may not intimidate, threaten, coerce, discriminate against, or retaliate against anyone for filing a complaint (45 CFR 164.530(g)). That is why the form says so at the top. In practice it means the complaint never goes in the medical record, and nobody changes how the patient is scheduled or billed because of it.
How to Handle a Complaint, Step by Step
- Take the complaint in any form: paper, phone, portal message, or in person. Fill in the form for the patient if they call.
- Acknowledge it quickly and tell the patient who is looking into it.
- Investigate. If it involves PHI, decide whether it is a security incident and complete the incident report form.
- Fix the underlying problem and record it; larger issues get a corrective action plan.
- Send the patient a response and record the date.
- File the form and keep it for six years, the HIPAA documentation period.
Hospitals have a stricter grievance rule
Hospitals in Medicare must run a formal grievance process under 42 CFR 482.13(a)(2), with set time frames and a written decision that names the contact person, the steps taken to investigate, the result, and the completion date. Outpatient practices are not bound by that rule, but the same written response is good practice.
When Patients Go to OCR Instead
Patients do not have to complain to you first. They can file directly with the HHS Office for Civil Rights, generally within 180 days of when they knew of the problem. A documented internal process, with a dated response, is the first thing OCR asks to see. Our guide on how to file a HIPAA complaint walks through the OCR side.
Most complaints are not privacy complaints