The HIPAA Privacy Rule authorizes patients and insureds of covered entities who believe that their health information confidentiality rights have been violated to complain to: The covered entity itself.

The Office for Civil Rights (OCR) within the federal Department of Health and Human Services (HHS).

Both the covered entity itself AND the Office for Civil Rights (OCR) within the federal Department of Health and Human Services (HHS). 

Neither the covered entity itself NOR the Office for Civil Rights (OCR) within the federal Department of Health and Human Services (HHS)