Your HIPAA Rights
HIPAA (Health Insurance Portability and Accountability Act) gives you rights over your protected health information (PHI). PHI means your health data that includes your name or other identifiers. Under HIPAA, you can:
- Access and get copies of your health records
- Ask for corrections if records are wrong or incomplete.
- Get a Notice of Privacy Practices from DHCS and your providers that explains how your data is used and shared.
Read the DHCS Notice of Privacy Practices for details.
Who enforces privacy
- US Department of Health and Human Services (HHS) Office of Civil Rights (OCR) enforces HIPAA rules and investigates HIPAA complaints.
- FTC (Federal Trade Commission) handles complaints about unfair or deceptive practices by apps and companies.
Read the FTC “How Websites and Apps Collect and Use Your Information” article for details.
How to file a complaint
If you believe that your health information has been improperly used or shared and your privacy rights have been violated, you have the right to file a complaint.
- HIPAA complaint: File online with the HHS OCR using the Complaint Portal Assistant or call 1‑877‑696‑6775. You generally must file within 180 days of the event. Extensions may be granted for good cause.
- App or app company complaint: Report with the Federal Trade Commission (FTC) at reportfraud.ftc.gov or call 1‑877‑FTC‑HELP.
- Medi‑Cal: Call 1‑800‑541‑5555.
- California Department of Public Health Privacy Office: Call 1‑916‑440‑7671 or email Privacy@cdph.ca.gov (for concerns about a DHCS‑approved app).
Why this information is here
Federal rules require states to post plain‑language resources about your HIPAA rights, privacy, security, and complaint options.
Information on the DHCS Non-Discrimination Policy and Language Access, including language access phone numbers and translation services.