Each covered entity must provide a process for individuals to make complaints about the covered entity's compliance with the HIPAA Privacy Regulations. Purdue adopted a process for individuals to complain about its policies and procedures, and any non-compliance with those policies or procedures, or the HIPAA Privacy Regulations. The process must include documentation of complaints received and their disposition, if any, and sanctions for any members of its workforce who fail to comply with the policies, procedures, or regulations.

HIPAA Complaint Process (pdf)

HIPAA Complaint Report (pdf)
HIPAA Complaint Report (doc)