Massachusetts Insurance, records, or privacy Complaint Route

Authority and scope

State insurance complaint scope

Massachusetts Division of Insurance Consumer Services; Office of Patient Protection for eligible medical-denial external review

The verification level applies to state insurance complaints only. Complaint instructions checked against the linked sources, with limitations and known conflicts. Confirm that the authority covers your concern.

DOI handles state-regulated insurance complaints and may require corrective action for violations of a policy or insurance law. Medical-necessity denials follow the separate Office of Patient Protection (OPP) external-review route for eligible fully insured Massachusetts coverage, including HMO coverage.

Supporting guidance: Filing An Insurance Complaint ↗OPP external-review instructions ↗OPP external-review packet ↗

Choose the insurance process

DOI insurance complaint

Policy and insurance-practice complaints

Open this official route ↗

OPP external review

Separate medical-denial review for eligible fully insured Massachusetts plans

Open this official route ↗

Submission

How the official source says to file

DOI: complete its linked online complaint form or use the form’s print-only option. Provide insurer/agent names, member/policy/claim numbers and supporting papers. DOI specifically says not to send medical records. Filing for a family member requires a signed, notarized power of attorney.
DOI: email the completed form to CSSComplaints@mass.gov, fax 617-753-6830, or mail Consumer Services Unit, 1 Federal Street, Suite 700, Boston, MA 02110. Help: 617-521-7794.
OPP: use its separate secure form or external-review packet with the final denial, relevant records, signed releases and $25 fee or hardship-waiver request. Submit online, fax 617-624-5046, or USPS without signature-required delivery to 50 Milk Street, 8th Floor, Boston, MA 02109. OPP says not to email personal health or other confidential information because it cannot guarantee security and confidentiality.

Supporting guidance: Filing An Insurance Complaint ↗OPP external-review instructions ↗OPP external-review packet ↗

Limits

What this route may not provide

DOI excludes Medicare, MassHealth, GIC and self-funded plans, and directs out-of-state policy issues to the appropriate regulator. It does not determine medical necessity or provide legal representation; its instructions say not to file when an attorney represents you or litigation is ongoing.

Supporting guidance: Filing An Insurance Complaint ↗OPP external-review instructions ↗

Anonymity

Do not guess about confidentiality

DOI sends the complaint and materials to involved licensees. OPP requires patient or legally authorized signatures; another adult’s family member cannot simply authorize record release. Its packet separately addresses representation, sensitive information, psychotherapy notes and permission to refer the case. OPP says medical records are exempt from public disclosure, with legally required disclosure exceptions.

Supporting guidance: Filing An Insurance Complaint ↗OPP external-review packet ↗

Complaint timing

DOI complaint deadline not established; OPP external review has a four-month deadline.

A filing deadline for an ordinary DOI complaint was not established by this check; ask promptly. OPP external review generally must be requested within four months after receiving the final adverse determination. Urgent review and requests to continue coverage have separate requirements; continuation requests can have a two-business-day window.

Supporting guidance: Filing An Insurance Complaint ↗OPP external-review instructions ↗OPP external-review packet ↗

Process

What may happen after filing

DOI screens jurisdiction, normally acknowledges or requests missing information within two weeks, and gives the respondent 30 days to answer. OPP separately screens eligibility and assigns an independent reviewer whose decision is binding.

Supporting guidance: Filing An Insurance Complaint ↗OPP external-review instructions ↗

Evidence

Prepare a reviewable submission

State the concern you want reviewed, give a short chronology and factual consequences, and explain your request. Keep supporting records and follow the receiving authority’s instructions before attaching or sending them.

Read the linked authority and process information ↗

Records, privacy and other coverage processes

This national guidance applies within each process’s stated scope. It does not verify every state’s records or privacy laws, establish state insurance filing requirements, or change the state verification level above.

Records access and amendment

HIPAA access generally covers a covered provider’s or health plan’s designated record set, with exceptions such as separately maintained psychotherapy notes. Access and amendment are different requests: access generally requires action within 30 days; amendment within 60 days. Each permits one written, explained 30-day extension. These are record-holder response periods. An accepted amendment may be appended or linked; it does not require erasing the original.

Supporting guidance: 45 CFR 164.524: access to protected health information ↗45 CFR 164.526: amendment of protected health information ↗

Privacy complaints and consent

HHS OCR accepts qualifying HIPAA and substance-use-record confidentiality complaints. Generally file within 180 days after you knew or should have known of the alleged violation; OCR may extend for good cause. OCR requires your name and contact information. Read its consent form: your identity may be disclosed, withholding consent can limit investigation, and legally permitted disclosures or referrals can occur. Covered retaliation is prohibited; report suspected retaliation to OCR. Filing does not guarantee enforcement or a personal remedy. The webpage and linked packet list different mail and email details; use the current process page and confirm the delivery instructions.

Supporting guidance: HHS OCR: health-information complaint process ↗HHS OCR: privacy complaint and consent packet ↗

Civil rights use a separate process

Discrimination or access concerns in covered health or human-services programs use OCR’s separate civil-rights instructions. A privacy complaint does not automatically raise a civil-rights claim.

Supporting guidance: HHS OCR: civil-rights complaint process ↗

Match insurance help to the plan

Ask the benefits administrator whether coverage is insured or self-funded. EBSA assists with ERISA-covered private-employer plans; both fully insured and self-funded private-employer plans can be covered. State insurer oversight and ERISA claim protections can coexist. Government and most church plans differ. A regulator complaint and a coverage appeal are separate. Follow the denial notice and plan documents; do not assume a complaint preserves an appeal deadline. External review depends on the plan, dispute and applicable process, rather than being available for every denial.

Supporting guidance: DOL EBSA: filing a claim for health benefits ↗DOL: group health plan fiduciary responsibilities ↗

Medicare and Medicaid

Medicare appeal instructions depend on the coverage involved. For Medicaid or CHIP, use the decision notice and state program to identify the applicable appeal, review or hearing route. If care is urgently needed or ending, promptly check the notice’s expedited-review instructions instead of relying on a routine complaint.

Supporting guidance: Medicare: appeals ↗Medicaid.gov: state Medicaid and CHIP help ↗DOL EBSA: filing a claim for health benefits ↗

National sources and scope

45 CFR 164.524: access to protected health information ↗

HIPAA designated-record-set access, exclusions and denials, format, fees and the record holder’s response period.