Two following steps should be considered for taking action if your private medical records have been improperly disclosed:

1. Contact the person or covered entity that’s responsible for the disclosure asking them to retrieve the disclosed records, and request that whoever received your information to destroy those copies
2. Contact HHS OCR to describe the alleged case requesting an investigation. If the OCR uncovers any HIPAA violations, the agency may discipline the person or entity responsible for the disclosure, or refer the matter to the DOJ for prosecution.

It’s important to file a complaint, “Health Information Privacy Complaint,” with OCR within 180 days of incident occurring. Unfortunately, HIPAA does not provide the right to sue in federal courts, but lawsuits that are filed in state courts may use HIPAA standards to create liability. Your state may provide several avenues of relief in terms of the right to sue for invasion of privacy or breach of doctor-patient confidentiality. You have to take action to enforce your rights.