Notice: As a result of increases in the Health Protection Condition (HPCON) level, our offices are limited to mission-essential personnel only and maximizing the use of telework for other personnel. This means that we are unable to handle requests sent via traditional methods such as postal mail. During this time, we can only respond to electronic inquiries while under elevated HPCON levels and request that when sending information to the DHA Privacy and Civil Liberties Office or the DHA Freedom of Information Act Service Center, please use the following addresses DHA.PrivacyOfficeMail@mail.mil or DHA.FOIA@mail.mil.
Please refrain from sending personally identifiable information or health related information as these mailboxes do not allow for your encrypted submission. However, in an abundance of caution, you may use the DoD SAFE (Secure Access File Exchange) via https://safe.apps.mil/ to upload and send your personal information. Please reference the above mailbox addresses for your submission. When using SAFE, we request that any personal information being transmitted must be encrypted prior to uploading and the decryption key must then be provided to the recipient(s) by a means other than SAFE.
Thank you for your understanding during this time. We will update our webpage when we return to normal operations.
You may file a written complaint if you think a military treatment facility (MTF), Military Health System (MHS) component, or MHS business associate is violating the Health Insurance Portability and Accountability Act (HIPAA) Rules or the MHS Notice of Privacy Practices (NoPP).
You may file a complaint with:
Filing a Complaint with the DHA Privacy Office
Please complete and mail the HIPAA Complaint Template to the below address:
Defense Health Agency
Privacy and Civil Liberties Office
7700 Arlington Boulevard, Suite 5101
Falls Church, VA 22041-5101
When filling out the template, please make sure your complaint:
- States which DoD covered entity (e.g, MTF, DHA etc.), or business associate you believe violated HIPAA or the NoPP;
- Includes as much detail as possible surrounding the violation (i.e., what happened, when it occurred, and who is the potential violator(s));
- Is filed within 180 days after you were made aware of the violation; and
- Is in paper form (electronic messages will not be accepted).
HIPAA Prohibits Retaliation
HIPAA does not allow covered entities and business associates to punish you for filing a complaint. If you think you are being punished for filing a complaint, please notify your MTF’s HIPAA Privacy Officer or the DHA Privacy Office.