Suppose an employee is out on PTO and her manager inappropriately explains to co-workers that she’s recovering from a hysterectomy. Who should the employee complain to about the impermissible disclosure of her health information? Although that has the ring of a HIPAA violation, the complaint belongs to human resources (HR), not compliance.

“Yes, this is an inappropriate disclosure, but since your boss isn’t your health care provider, it’s not a HIPAA violation. It’s a violation of human resources confidentiality standards,” said Jennifer Munro, manager of integrity & compliance, education, communication and the hotline system at Trinity Health, a system based in Livonia, Michigan. But sometimes knowing where to report complaints can be confusing to people.

Getting concerns into the right hands is a challenge for compliance programs. “Everybody has that problem,” Munro noted. “You don’t want to discourage people from calling the hotline, but you want them to go to the right place because you’re wasting the time of compliance officers and the callers. We get about 1,800 hotline calls annually and over half are about HR-related concerns.”