How to File a Patient Grievance or Complaint

A hospital billing error, a care decision that felt wrong, a nurse who dismissed a concern that turned out to matter — these are the moments that send people searching for a complaints process. Filing a patient grievance is a formal, federally protected mechanism for raising concerns about care, billing, rights violations, or provider conduct. Knowing how the system is structured, and which channel to use, determines whether a complaint reaches someone with authority to act on it.

Definition and scope

A grievance and a complaint are related but distinct categories under federal health law — and the difference shapes where a concern lands.

Under the Centers for Medicare & Medicaid Services Conditions of Participation, hospitals are required to have a formal grievance process. A complaint is typically an informal concern raised verbally and resolved at the point of care, often within 24 hours. A grievance is a written — or formally escalated verbal — concern that a patient submits to the hospital's grievance committee. Hospitals must acknowledge written grievances within 7 days and resolve them within no more than 30 days under CMS standards, with a written response sent to the patient.

The scope covers virtually all care settings: inpatient, outpatient, telehealth, long-term care, and behavioral health. It extends beyond clinical decisions to include billing disputes, privacy violations under HIPAA, language access failures, and informed consent breakdowns. The patient bill of rights framework, reinforced by the Affordable Care Act, establishes these protections as baseline standards — not optional courtesies.

How it works

The grievance pipeline has three broad tiers, each with increasing external authority.

1. Internal hospital grievance process. The first step is filing with the hospital's Patient Relations or Patient Advocate department. Submit the complaint in writing to create a paper trail. Under CMS Conditions of Participation (42 CFR § 482.13(a)(2)), the hospital must provide a written notice of its decision, including the name of the hospital contact, steps taken to investigate, the results, and the date of completion.

2. State agencies and licensing boards. If the hospital's response is unsatisfactory, or if the complaint involves a licensed individual provider, the state health department or professional licensing board is the next channel. State agencies can investigate, impose fines, and suspend licenses. The relevant office varies by state; a full map of state-level protections is covered in state patient rights laws.

3. Federal enforcement agencies. For HIPAA violations, complaints go to the HHS Office for Civil Rights, which has authority to impose civil penalties up to $1.9 million per violation category per year (HHS OCR HIPAA Enforcement). For Medicare and Medicaid patients, Quality Improvement Organizations (QIOs) handle care quality disputes, and CMS itself handles systemic Conditions of Participation violations. For emergency care situations involving possible EMTALA violations, complaints go directly to CMS.

For nursing home residents, a parallel system exists through the Long-Term Care Ombudsman Program, established under the Older Americans Act, which operates in all 50 states and the District of Columbia.

Common scenarios

Most grievances fall into a recognizable cluster of situations:

• Discharge disputes. A patient believes they are being discharged too early. Under Medicare rules, patients have the right to a fast-track appeal through their QIO, which must issue a decision by midnight of the day after receiving the request — without cost to the patient.
• Billing and coverage denials. A claim is denied or coded incorrectly. This intersects with insurance denial rights and may require both a provider grievance and a separate insurer appeal.
• Privacy breaches. Medical information is shared without authorization. HIPAA complaints must be filed with HHS OCR within 180 days of when the complainant knew or should have known of the violation.
• Discrimination in care. A patient is treated differently based on race, language, disability, or other protected characteristics. Language access failures specifically fall under Title VI of the Civil Rights Act, enforced through HHS OCR, and are detailed further in language access rights in healthcare.
• Informed consent failures. A procedure was performed without adequate disclosure of risks. This overlaps with both internal grievance channels and state medical board jurisdiction.

Decision boundaries

The choice of channel is not purely sequential — it depends on what outcome the patient is seeking and what happened.

A complaint seeking an apology or a corrected bill is well-suited to the internal grievance process. A complaint alleging a civil rights violation or a HIPAA breach requires a federal agency filing — the hospital cannot investigate itself for federal law violations with binding authority. A complaint involving potential professional misconduct by a licensed provider (a physician, nurse, or therapist) requires a separate filing with the relevant state licensing board, regardless of what the hospital's internal process concludes.

Time limits matter. State licensing board complaint windows vary from 1 year to 4 years depending on jurisdiction. HHS OCR's 180-day window for HIPAA complaints is strict, though exceptions exist for continuing violations. The grievance and appeals process page outlines appeal timelines in greater detail, and the patient advocate role covers how a professional advocate can help navigate simultaneous filings across channels.

Patients who believe a patient rights violation has occurred that rises to the level of legal harm — physical injury, significant financial damage, or systemic discrimination — should also review whether civil litigation is an available remedy, a question addressed in suing for patient rights violations.