1. Filing a complaint - Individuals who have complaints concerning the Department's or the CFC's HIPAA privacy policies and procedures ("policies and procedures"), or the Department's or the CFC's compliance with those policies and procedures, may submit a complaint.
  2. Complaints about the DHS policies and procedures or actions - If the complaint concerns the Department's policies and procedures or actions by Department staff (for example, if the complaint is that the Department's amendment procedure violates HIPAA, or that DHS staff inappropriately refused to amend a record maintained by the Department), the individual shall be directed to submit the complaint in writing to the Bureau of Early Intervention's Privacy Officer at:
    HIPAA Privacy Officer
    DHS - Bureau of Early Intervention
    222 South College, 2nd Floor
    Springfield, IL 62704
  3. Complaints about the CFC's policies and procedures or actions - If the complaint concerns the CFC's policies and procedures or its actions (for example, if the complaint is that the CFC wrongfully denied a request to amend a record within its control), the complainant shall be directed to submit the complaint in writing to the Program Manager at the CFC. If the CFC receives a complaint that is about the Department, the CFC shall immediately forward the complaint to the Bureau of EI for disposition.
  4. Responding to a complaint about the Department - When the complaint is about the Department, the Privacy Officer (or his or her designee) for the Department will review the complaint and conduct an investigation as appropriate, and inform the complainant as to the disposition of the complaint within 30 days of the receipt of the complaint. If a disposition is not made within the 30-day period, the Department will inform the complainant as to the time frame within which a disposition will be made.
  5. Responding to a complaint about the CFC - When the complaint is about the CFC, the Privacy Officer for the CFC (or Program Manager or other designated staff) will review the complaint and conduct an investigation as appropriate, and inform the complainant as to the disposition of the complaint within 30 days of the receipt of the complaint. If a disposition is not made within the 30-day period, the CFC will inform the complainant as to the time frame within which a disposition will be made.
  6. Responding to a complaint about a provider - When the complaint is about a provider's HIPAA policies and procedures or actions, the complainant shall be directed to send the complaint to the provider. A copy of the complaint must also be sent to the Bureau of EI, as it may be considered a "state complaint" under 89 Ill. Admin. Code 500.
  7. Responding to a complaint about the CBO - When the complaint is about the CBO's HIPAA policies and procedures or actions, the complainant shall be directed to send the complaint to the CBO, with a copy to the Department's Bureau of EI.
  8. Documenting the complaint - All complaints received by the Bureau of EI and the CFC must be documented by the Bureau and the CFC respectively, along with the disposition of the complaint, if any. When the complaint is about the CFC, the CFC will immediately forward a copy of the complaint to the Bureau, as it may be considered a "state complaint" under 89 Ill. Admin. Code 500. The CFC shall also forward a copy of the disposition of the complaint to the Bureau at the address listed under number 2 above upon disposition of the complaint.
  9. Non-exclusive - This complaint procedure does not replace or usurp the procedures for filing a complaint about an alleged violation of HIPAA with the U.S. Department of Health and Human Services pursuant to 45 CFR 160.306, or a State Complaint with the Bureau of EI.
  10. Non-retaliation - Neither the Department nor the CFC, or their respective employees, may intimidate, threaten, coerce, discriminate against, or take other retaliatory action against an individual for:
    1. The exercise of any right or for participation in any process established under HIPAA, including filing of a complaint;
    2. Filing a complaint with the Secretary of the U.S. Department of Health and Human Services under HIPAA;
    3. Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under Part C of Title XI; or
    4. Opposing any act or practice made unlawful by HIPAA, provided the individual has a good faith belief that the opposed practice is unlawful, and the manner of the opposition is reasonable and does not involve a disclosure of PHI in violation of any provision of the HIPAA privacy rule.
  11. No waiver of rights - Neither the Department nor the CFC may require individuals to waive their rights under HIPAA as a condition of the provision of treatment, payment or eligibility for EI services.