§160.316 Refraining from intimidation or retaliation.
A covered entity or business associate may not threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual or other person for—
(a) Filing of a complaint under §160.306;
(b) Testifying, assisting, or participating in an investigation, compliance review, proceeding, or hearing under this part; or
(c) Opposing any act or practice made unlawful by this subchapter, provided the individual or person has a good faith belief that the practice opposed is unlawful, and the manner of opposition is reasonable and does not involve a disclosure of protected health information in violation of subpart E of part 164 of this subchapter.
Make sure you are Omnibus Rule Compliant: HIPAA Privacy Checklist.