In the first instance, you should contact the hospital and request an accounting of disclosures. This will tell you who the information was disclosed to and for what reason. If the disclosure is not allowable, you should complain in the first instance to the hospital´s HIPAA Privacy Officer. If you then decide to escalate the complaint, you can call your state´s Department of Health & Human Services or file a complaint online via the OCR complaints portal.