Previously, I’d complained to the office manager that I could hear the staff talking about patients when they were in conversation with the lab or other offices. I mentioned “breach of privacy/confidentiality” and was told (condescendingly) there is nothing they can do because they have to work at the reception desk, i.e., there’s no private office.

Here’s the shocker: on my return visit I asked for receipt of payment & learned they are recycling their paper. When I got home I discovered that the backside of the receipt is a laboratory report with two patient names (first/last). Both names are unusual so I Googled them. I found the patients’ names, addresses, phone #, age, etc. While this many be an unintended HIPAA breach, it’s clearly a violation of privacy.

Should I report this breach to the doctor or file a formal complaint?