Want to know what would likely happen... You MIGHT get someone fired. They'll have a privacy policy. You probably received a copy and were asked to sign for it's receipt - fairly standard practice now. And this will be against their stated policy. And if you complain they will take action as prescribed by HIPAA. So they are liekly attempting to comply with HIPAA - which stated there need to be policies, procedures, and safeguards in place (particularly for EDI). I'd still complain if I were you... but I don't think you just hit the lottery (that is, I don't think you'll be seeing a check with lots of 0's on it) from this.
BTW - in general you have 180 days to file a complaint.
http://www.hhs.gov/ocr/privacyhowtofile.htm
Sanctions
In § 164.518(e) of the NPRM, we proposed to require all covered entities to develop, and apply when appropriate, sanctions against members of its workforce who failed to comply with privacy policies or procedures of the covered entity or with the requirements of the rule. Covered entities would be required to develop and impose sanctions appropriate to the nature of the violation. The preamble stated that the type of sanction applied would vary depending on factors such as the severity of the violation, whether the violation was intentional or unintentional, and whether the violation indicated a pattern or practice of improper use or disclosure of protected health information. Sanctions could range from a warning to termination.