An OCR Investigation, Start to Finish: What Actually Happens
Most practices have never seen an OCR investigation and imagine either a raid or a formality. It is neither. It is a document-driven process with hard deadlines, and the outcome is largely decided by what you already had on file the day the letter arrived.
Stage 1: The letter and the 10-business-day clock
The opening letter identifies the matter — a complaint, a breach report you filed, or a compliance review — and includes an initial data request. You typically have 10 business days from the date on the letter, not the date you opened it. The first three things to do are notify leadership, engage healthcare counsel, and issue a litigation hold that stops routine deletion of logs, email, and backups.
Stage 2: Assembling the response
The request will almost always lead with the Security Risk Analysis, then policies, then evidence that those policies operate. Map every line of the request to a document and an owner on day two. The list of items that do not exist is the one that determines your week.
- →Answer exactly what was asked — volunteering extra material widens the scope
- →Submit one indexed package that cross-references each request item
- →Request an extension in writing before the deadline if you need one, with a firm date
- →Never backdate anything; a compliance problem is survivable, a false statement is not
Stage 3: Follow-up questions
Expect a second round two to six weeks after submission, narrowed to whatever looked thin. This is where an inconsistency between your breach report and your evidence becomes expensive, so keep the whole record internally consistent and answer the second round with the same discipline as the first.
Stage 4: The three ways it ends
Investigations resolve in one of three ways, and the distance between them is mostly determined by the quality of the evidence and the credibility of your corrective action.
- →Closed with no findings — the record supported compliance
- →Technical assistance — informal guidance and a closure letter, no penalty
- →Resolution Agreement with a corrective action plan and a monetary settlement, typically with one to three years of monitoring and reporting
How long the whole thing takes
A straightforward complaint investigation with a clean response often closes in three to six months. Matters involving a large breach, or where the initial response was weak, routinely run past a year. The single largest driver of duration is how many follow-up rounds the first submission provokes.
Where practices lose control
Three failure modes recur. Missing the deadline without requesting an extension, which converts a document exercise into a question of cooperation. Submitting a vendor attestation letter as though it were a Security Risk Analysis, which reviewers recognise instantly and which puts everything else you submitted in doubt. And responding without counsel, which usually means over-disclosing and widening the investigation into areas nobody had asked about.
What good preparation looks like
The practices that close these matters quickly did the work beforehand: a current risk analysis, an evidence index maintained year-round, and a named person who knows where every document lives. None of that is exotic. It is a folder that stays current, and it is the difference between a fortnight of controlled work and a year of escalating requests.
Key takeaways
- 1.The clock runs from the letter date, and extensions must be requested in writing beforehand
- 2.The Security Risk Analysis is the first thing requested and the most common finding
- 3.Answer exactly what was asked — over-disclosure widens the investigation
- 4.Maintaining the evidence index year-round is what turns a year into a fortnight