How a 4-Location Dental Group Passed an OCR Desk Audit With Zero Findings
An OCR data request landed with a 10-business-day clock and no current Security Risk Analysis on file. Six weeks later the group closed the audit with zero findings.
At a glance
4 locations · 11 providers · 48 staff
The challenge
The group received an OCR desk audit letter following a complaint filed by a former employee. The initial data request gave them 10 business days to produce a Security Risk Analysis, Security Rule policies, and evidence of implementation across all four sites. Their most recent risk analysis was 4 years old and covered only the original location.
- Security Risk Analysis 4 years stale and scoped to one of four locations
- No consolidated policy set — each site had drifted to its own procedures
- Workforce training logs kept on paper, unsigned, and incomplete for 2 of 4 sites
- Business Associate Agreements missing for the imaging vendor and the billing service
What we did
- 1
Emergency scoping call within 24 hours
We mapped the OCR request line by line against what the group could actually produce, and identified the four items that would have generated findings if submitted as-is.
- 2
Enterprise-wide Security Risk Analysis
A NIST 800-30 aligned SRA covering all four locations, including ePHI data-flow mapping across the shared EHR, imaging system, and off-site backup.
- 3
Policy consolidation
One policy set covering all 54 Security Rule implementation specifications, adopted by written resolution at each location so the effective dates were defensible.
- 4
Evidence package assembly
Training re-run and attested electronically, BAAs executed with both outstanding vendors, and quarterly access reviews reconstructed from system logs.
- 5
Response filed with an extension request
We filed a documented extension request on day 8 — granted — then submitted a single indexed evidence package cross-referenced to each item in the OCR request.
The outcome
OCR closed the matter with no findings and no corrective action plan. The group now runs an annual SRA and a quarterly evidence review with Atascocita IT, so the next data request is a matter of exporting a folder rather than rebuilding four years of records.
We had ten business days and a four-year-old risk analysis. The indexed evidence package was the difference between a closed matter and a corrective action plan.
Services used in this engagement
More case studies
Client identities are protected under our Business Associate Agreements. These engagement stories are anonymised composites drawn from real Atascocita IT audits of the practice type described; metrics reflect the documented outcomes of those engagements.