Contact the person or entity responsible for the disclosure, ask them to retrieve the disclosed records, and request that whoever received them destroy their copies. The responsible party may be willing to help you in the event that an error has occurred. Contact HHS to describe the alleged incident and request an investigation. If HHS uncovers any HIPAA violations, the agency may warn or discipline the person responsible for the disclosure, or refer the matter to the Department of Justice for prosecution.
