Complaint handling and mitigation policy

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.530(d) (complaints to the covered entity); 164.530(f) (mitigation); 164.530(g) (refraining from intimidating or retaliatory acts); 164.530(h) (no waiver of rights); 164.530(j) (documentation). Patient-rights requests that arrive as complaints are also handled under document 09.

Approved by Dr. Maria Lindqvist, Owner. Policy owner: Janelle Okafor, Office Manager. Backup designee: Dr. Maria Lindqvist.

Purpose

A patient who believes Granite City Family Dental has mishandled their health information must have an easy way to say so, must be heard promptly, and must never be worse off for having complained. This policy sets out how complaints are received, acknowledged, investigated and answered, and what the practice does to limit harm whenever it learns that PHI was used or disclosed in a way its policies do not allow. The complaint log at the end is kept even in a year with no complaints.

Part A — Complaint handling

1. Who receives complaints

Janelle Okafor receives privacy complaints for Granite City Family Dental, as printed in the Notice of Privacy Practices (document 06). Janelle Okafor owns the investigation. When the Privacy Officer is unavailable for more than two business days, Dr. Maria Lindqvist acts in their place. A complaint about the Privacy Officer personally goes to Dr. Maria Lindqvist, Owner and Dentist.

Any workforce member who receives a complaint, in any form, writes down the date, the patient's name and contact details and what was said, and hands it to Janelle Okafor the same day. Staff do not argue with the patient, do not promise an outcome and do not try to resolve the matter themselves.

2. How a patient may complain

Patients, personal representatives, family members and workforce members may complain. No form is required; a complaint spoken at the front desk counts and is written down by the person who hears it. Granite City Family Dental accepts complaints through the following channels:

• In person at any location, or by phone to Janelle Okafor at 320-555-0142.
• In writing by mail, addressed to the Privacy Officer, Granite City Family Dental, 412 2nd Street South, St. Cloud, MN 56301.
• By email to Janelle Okafor at [email protected]. Patients are told not to include detailed health information in an unencrypted email; the officer calls back if detail is needed.

The same channels are printed in the Notice of Privacy Practices, and the notice also tells patients how to complain to the Secretary of Health and Human Services (section 7 below).

3. Acknowledgment

Janelle Okafor enters every complaint in the complaint log on the day it is received and acknowledges it to the complainant within 5 calendar days, by the channel the complainant used unless they ask for another. The acknowledgment states that the complaint was received, who is handling it, and that a written response will follow. If the complaint is actually a request to see, copy, amend or restrict a record, the request is logged under document 09 as well and its 30-day clock starts the day it arrived.

4. Investigation

1. Clarify. The investigator reads or listens to the complaint and, where needed, calls the complainant to make sure the concern is understood: which information, which people, which date.
2. Decide what rules apply. The investigator identifies which policies in this binder and which parts of 45 CFR Part 164 the facts touch (a disclosure, a safeguard, a patient right, a workforce action).
3. Gather the facts. EHR audit trails, fax and email logs, sign-in sheets, schedules, statements from the staff involved and, where relevant, camera footage are collected within ten business days. Staff cooperate fully; the investigator keeps the complainant's identity to those who need it.
4. Conclude. The investigator records whether the practice's policy was followed and whether PHI was used or disclosed impermissibly. The conclusion is written in the complaint file with the evidence relied on.
5. Act. If a violation occurred: mitigation under Part B starts at once; the incident is entered in the incident log (document 16) and handed to Janelle Okafor with counsel for the four-factor assessment under document 22 if PHI may have been compromised; workforce conduct is referred under the sanction policy (document 05), imposed by Privacy Officer with the owner's approval; any policy, training or system weakness that let the event happen is entered in the risk register with an owner and due date.
6. Record. Every step is dated in the complaint file. A complaint is not closed until the written response has gone out and every action in step 5 has an owner.

5. Written response

The complainant receives a written response within 30 calendar days of the complaint, or sooner. It says in plain language what was looked into, what was found, and what the practice has done or will do. It does not name other patients and does not disclose details of a workforce member's discipline beyond stating that appropriate action was taken. If more time is needed, the complainant is told in writing before day 30 why, and when to expect the response. The response is signed by Janelle Okafor and a copy is kept in the complaint file.

6. No retaliation and no waiver of rights

Authority: 45 CFR 164.530(g) and (h).

Granite City Family Dental does not intimidate, threaten, coerce, discriminate against or take any retaliatory action against any person for filing a complaint with the practice or with HHS, for taking part in an investigation, compliance review or hearing, or for opposing in good faith any act they reasonably believe is unlawful under HIPAA. Care, scheduling and billing are unaffected by a complaint. A workforce member who retaliates is sanctioned under document 05; this applies to owners and providers as well as staff.

The practice never asks a patient to waive the right to complain to HHS or to the practice as a condition of treatment, payment, enrollment or eligibility for benefits. No intake form, consent or financial agreement used by Granite City Family Dental contains such a waiver, and any form found to contain one is withdrawn.

7. Complaining to the Secretary of Health and Human Services

A patient may complain directly to the HHS Office for Civil Rights, without first complaining to the practice. Staff give this information to any patient who asks, and it appears in the Notice of Privacy Practices:

• Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201
• Phone: 1-877-696-6775
• Online: www.hhs.gov/ocr/privacy/hipaa/complaints/
• A complaint to OCR must be filed within 180 days of when the person knew or should have known of the act complained of; OCR may extend that period for good cause.

If OCR, the Minnesota Department of Health, a licensing board or the state Attorney General contacts the practice about a complaint, the person who receives the contact gives it to Janelle Okafor and Dr. Maria Lindqvist the same day. The practice cooperates, provides records on request, and consults counsel before responding in writing.

8. Documentation

Each complaint file holds the complaint as received, the acknowledgment, the investigation notes and evidence, the conclusion, the response, and the record of mitigation, sanctions and risk-register entries that followed. Files are kept in This binder (CRU HIPAA Binder Builder, exported yearly) and a printed copy in the administrator's locked office. for six years from the date the complaint is closed, then destroyed by Cross-cut shredding for paper; secure deletion of electronic copies after the retention period.. Authority: 45 CFR 164.530(d)(2), (j).

9. Review

The Privacy Officer reports the year's complaints, response times and outcomes at the annual review meeting (document 24). A pattern of complaints about one topic, one location or one person is treated as a risk and entered in the risk register.

Part B — Mitigation

Authority: 45 CFR 164.530(f).

1. The duty

Granite City Family Dental mitigates, to the extent practicable, any harmful effect it knows of from a use or disclosure of PHI by its workforce or by a business associate that violates this binder's policies or the Privacy Rule. The duty arises the moment the practice learns of the violation, whether from a complaint, a staff report, an audit log, a patient's phone call or a vendor's notice. Mitigation is not optional and does not wait for the breach assessment to finish: what can be undone is undone first, then the assessment proceeds.

2. Catalogue of mitigation steps

Janelle Okafor selects the steps that fit the event from the list below, adds others as the facts require, and writes down each step with its date in the complaint or incident file.

3. Violations by a business associate

When a business associate reports, or the practice discovers, an impermissible use or disclosure on the associate's side, the practice does not treat it as the associate's problem alone. The Privacy Officer obtains the associate's account in writing, confirms the associate has mitigated, carries out the four-factor assessment itself when the associate's report is incomplete, and makes any notifications the practice is responsible for under document 22. Repeated or uncured violations are grounds to end the agreement under 45 CFR 164.504(e)(1)(ii).

4. Tie-in to the incident log and breach assessment

Every event that triggers mitigation is entered in the incident log kept under document 16, with the date, what happened, who was involved and the mitigation taken, even when the event came in as a complaint rather than a security report. Where PHI may have been compromised, Janelle Okafor with counsel completes the four-factor worksheet in document 22; the mitigation already taken is factor four of that assessment and is one of the reasons an event may be found to present a low probability of compromise. The decision either way is written down. Janelle Okafor includes any breach in the under-500 annual report due by March 1.

5. Recording and review

Mitigation records are kept with the complaint or incident file for six years. At the annual review the Privacy Officer reports how many events required mitigation, what was done, and which risk-register items came out of them.

Complaint log — 2026

Authority: 45 CFR 164.530(d)(2). One row per complaint, entered the day it arrives. A year with no complaints is recorded with one row dated at the annual review reading "No complaints received". Complaints entered in the request log of document 09 appear here automatically.

Log reviewed at the annual meeting by: ___________________________ Date: ______________

Complaint record

Purpose: to document a privacy complaint received by Granite City Family Dental and the steps taken to resolve it. Complete on the day the complaint is received and keep with the complaint file.

Date received: ______________ Received by: __________________________________________

How received: [ ] In person [ ] Phone [ ] Mail [ ] Email [ ] Portal [ ] Other

Complainant name: __________________________________________

Relationship to patient (self, representative, family, other): __________________________________________

Preferred contact method and details: __________________________________________

Summary of the complaint (what happened, when, who was involved):

__________________________________________________________________________

__________________________________________________________________________

__________________________________________________________________________

Acknowledged on: ______________ (within 5 days) By: __________________________________________

Investigator: Janelle Okafor Evidence gathered: __________________________________________

Conclusion: [ ] Policy followed; no violation [ ] Violation found [ ] Could not be determined

Mitigation steps taken and dates: __________________________________________

Entered in incident log? [ ] Yes [ ] Not applicable Four-factor assessment needed? [ ] Yes [ ] No

Sanction referral? [ ] Yes [ ] No Risk register entry? [ ] Yes [ ] No

Written response sent on: ______________ Date closed: ______________

Complainant told how to contact HHS OCR? [ ] Yes

Privacy Officer signature: ___________________________ Date: ______________

Approval

Policy approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Privacy Officer: Janelle Okafor Signature: ___________________________ Date: ______________