To report falsified medical records, file a written complaint with your state medical board against the individual provider, file a HIPAA complaint with the HHS Office for Civil Rights within 180 days, and — if Medicare or Medicaid billing is involved — submit a tip to the HHS Office of Inspector General. A complaint to your state health department or the facility’s accreditor covers hospitals and clinics. Before you file anywhere, get a full copy of your records and the electronic audit trail so the alteration is documented.
Pull Your Records and the Audit Trail First
A complaint lands harder when it arrives with proof. Under HIPAA’s Privacy Rule, you have the right to inspect and obtain copies of your protected health information, and the provider must act on your request within 30 days, with one possible 30-day extension if they give you a written explanation.1eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information Psychotherapy notes and material compiled for litigation sit outside this right, but your clinical chart, labs, and treatment notes do not.
Request records from every provider involved, not just the one you suspect. Compare what’s in the chart against your own appointment confirmations, prescription receipts, patient portal messages, emails, and voicemails. Pull your explanation-of-benefits statements and billing invoices too. Charges for services you never received, or codes that don’t match your actual care, point directly at fabricated documentation.
Then ask for the audit log. Since 2014, certified electronic health record systems in the United States have been required to record who accessed or modified a patient’s record, what they changed, and when. A log showing your chart was altered days or weeks after your visit — particularly after you raised a complaint — is among the strongest evidence you can bring to a regulator.
Request an Amendment Under HIPAA
Alongside your complaints, use HIPAA’s amendment right. Submit a written request to the provider explaining what’s wrong and why. They have 60 days to act, with one 30-day extension available.2eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
If they deny it, they must give you a written explanation, and you have the right to file a “statement of disagreement.” The provider must attach that statement, or an accurate summary of it, to the disputed record and include it whenever they share the information going forward.2eCFR. 45 CFR 164.526 – Amendment of Protected Health Information Every future reader of the chart is then on notice the record is contested. The denial itself becomes evidence for your regulatory complaint.
Where to File a Complaint
No single agency handles every kind of falsification. The right channel depends on who altered the record and why. Filing with more than one is common.
State Medical Board
State licensing boards have authority over individual practitioners. A doctor, nurse, or other licensed professional who falsifies records can face fines, suspension, or permanent revocation of the license. File in writing, describe the falsification clearly, and attach your evidence. Investigations often take months, but a substantiated finding stays on the provider’s record.
HHS Office for Civil Rights
OCR enforces HIPAA’s Privacy and Security Rules and is the federal agency to contact when a provider has falsified your records, blocked your access to your chart, or refused to process an amendment request.3HHS.gov. HIPAA Enforcement Complaints go through the HHS website. The deadline is 180 days from the date you knew or should have known about the violation, though OCR can extend that period for good cause.4HHS.gov. How to File a Health Information Privacy or Security Complaint
OCR has settled or imposed civil penalties in 152 cases totaling more than $144 million and has referred over 2,400 cases to the Department of Justice for criminal investigation.5Health and Human Services. Enforcement Highlights
HHS Office of Inspector General
When falsified records are tied to billing fraud against Medicare or Medicaid — documenting services that never happened, or upcoding for higher reimbursement — the HHS Office of Inspector General is the right agency. The OIG Hotline takes online tips and phone calls at 1-800-HHS-TIPS (1-800-447-8477).6Office of Inspector General, U.S. Department of Health and Human Services. Submit a Hotline Complaint The OIG investigates fraud, waste, and abuse across HHS programs and can refer cases for criminal prosecution.
State Health Department
State health departments regulate healthcare facilities rather than individuals. If a hospital, clinic, or nursing home is involved, particularly where patient safety is at risk, a complaint can trigger an inspection or audit. Inspectors review records, interview staff and patients, and assess compliance. Confirmed violations can bring sanctions, mandatory corrective action, or loss of the facility’s license.
The Joint Commission
If the facility is accredited by the Joint Commission, you can report a patient safety concern through their online submission form or by calling 1-800-994-6610.7Joint Commission. Report a Patient Safety Concern or File a Complaint Note one limitation: the Joint Commission does not accept copies of medical records, photos, or billing documents, and will shred them if mailed. Describe the concern in the submission and hold your documentation for the other agencies.
Deadlines That Matter
Filing windows are shorter than most people expect. OCR gives you 180 days from when you knew or should have known about the HIPAA violation.4HHS.gov. How to File a Health Information Privacy or Security Complaint OSHA whistleblower complaints under the Affordable Care Act’s anti-retaliation provision also run 180 days from the retaliatory action, and other statutes OSHA enforces carry their own deadlines, some as short as 30 days.8OSHA. OSHAs Whistleblower Protection Program
State medical boards and health departments set their own timeframes, which vary. If you don’t know which deadline applies to your situation, file the complaint you can identify now and get advice on the others quickly.
If You’re Reporting as an Employee
Workers who report falsification often face retaliation, and there is a separate reporting track built around that risk. When the falsified records are tied to fraud against Medicare, Medicaid, or another government healthcare program, the False Claims Act protects employees, contractors, and agents who report the fraud. If you are fired, demoted, suspended, harassed, or otherwise retaliated against, you are entitled to reinstatement, double back pay with interest, and compensation for special damages including attorney’s fees. You have three years from the retaliatory action to file suit in federal court.9Office of the Law Revision Counsel. 31 US Code 3730 – Civil Actions for False Claims
The FCA also allows a “qui tam” lawsuit filed on the government’s behalf. If the case succeeds, the whistleblower receives 15 to 25 percent of the recovery when the government joins the case, or 25 to 30 percent when the government declines and the whistleblower litigates it.9Office of the Law Revision Counsel. 31 US Code 3730 – Civil Actions for False Claims Total FCA settlements and judgments exceeded $6.8 billion in fiscal year 2025.10United States Department of Justice. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025 The statute of limitations for a qui tam action is the longer of six years from the fraud or three years from when a responsible government official knew or should have known, capped at 10 years from the violation.11Office of the Law Revision Counsel. 31 US Code 3731 – False Claims Procedure
Most states also prohibit retaliation against workers who report healthcare violations, and some allow anonymous complaints. Protections and deadlines vary widely, so an employment attorney familiar with your state’s whistleblower laws is worth consulting early.
If the Falsification Caused You Harm
Reporting addresses the conduct. It does not compensate you. If falsified records contributed to a misdiagnosis, delayed treatment, or an unnecessary procedure, that is a separate civil malpractice question, and a medical malpractice attorney is the right next call. Bring your full records, your timeline, any amendment denials, and the audit trail you collected — the same evidence that supports your regulatory complaints is what an attorney will want to see.