Mistaken identity in child's medical records: Possible HIPAA violation?

Question

I recently downloaded medical records for my child and noticed an unrelated person's name on the records. I called the medical office to inquire how this name was added, but the receptionist could only offer to remove it, without explaining how or when the error occurred. I've stressed the need for an investigation, but was told there is no specific timeline for reaching out to me. I also attempted to contact patient relations but received no response. Could this be a HIPAA violation or negligence, and what steps can I take to address this?

Jonathan R. Ratchik · Answer

If the records you received related to another child / patient, then it might very well constitute a HIPAA violation. That said, HIPAA does not create a private cause of action for the aggrieved party (or for the individual who inadvertently received their medical records). Apart from perhaps reporting the violation, there's not much else you can do. https://www.hhs.gov/hipaa/filing-a-complaint/index.html

Tim Akpinar · Answer

Yes, this could be a HIPAA violation. I'm sorry for your frustration. It's understandable that you have concerns about protecting the privacy of your child. From a practical standpoint, a primary recourse is a complaint. Beyond that, you could check with attorneys in the health care field for additional options. Good luck

James L. Arrasmith · Answer

Yes, what you experienced may involve a HIPAA violation, especially if your child’s records were mixed with someone else’s or another patient’s information was disclosed to you without proper authorization. Medical records should be accurate and confidential, and any mix-up like this is taken seriously under federal law. Even if the receptionist removed the error, you have a right to know how it happened and what steps are being taken to prevent it from happening again. 
 
You’ve already done the right thing by contacting the office and patient relations, but don’t stop there. Put your concerns in writing and send them to the clinic’s privacy officer or compliance department, requesting a formal investigation. Keep a copy for your records and include specific dates, names, and a detailed account of what you discovered. When communication stalls, written complaints are harder for institutions to ignore. 
 
You also have the right to file a complaint with the U.S. Department of Health and Human Services if the office fails to respond. This isn’t just about correcting a name — it’s about protecting your child’s privacy and ensuring the integrity of their health records. Mistakes like this can follow someone for years if left unresolved. Keep advocating, because you deserve answers and accountability.

Q: Mistaken identity in child's medical records: Possible HIPAA violation?