The three most common complaints to OCR from patients concern privacy violations such as impermissible uses and disclosures of PHI (for example, using a patient´s PHI for marketing purposes without the patient´s authorization), lack of patient access to PHI, and uses and disclosures of more PHI than necessary in violation of the minimum necessary standard.