: Complain directly to the organization's HIPAA Compliance Officer .
If you need to report a breach or violation involving PHI (such as the unauthorized disclosure of patient ZIP codes), you can take the following steps:
: File a formal complaint with the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) .