Question 1

What triggers an OCR HIPAA investigation?

Accepted Answer

Three routes. A complaint, most often from a patient or a former employee, which is the most common by a wide margin. A breach report you filed yourself — automatic follow-up applies to breaches affecting 500 or more individuals. Or a compliance review initiated by OCR without a complaint, sometimes prompted by media coverage.

Question 2

How long do we have to respond to an OCR data request?

Accepted Answer

Typically 10 business days from the date on the letter, not the date you opened it. Extensions are sometimes granted when requested in writing before the deadline with a specific reason and a firm proposed date. Silence past the deadline is treated as non-cooperation and escalates the matter well beyond the original question.

Question 3

What does OCR ask for first?

Accepted Answer

The Security Risk Analysis, nearly always. Then Security Rule policies, then evidence that those policies operate: training logs, access reviews, encryption status, and Business Associate Agreements. A missing or stale risk analysis is the most frequently cited finding in the enforcement record and reliably widens the scope of everything that follows.

Question 4

What happens if we cannot produce a risk analysis?

Accepted Answer

Say so plainly, commission one immediately, and submit it with its completion date and your remediation plan. Practices that acknowledge the gap and show credible corrective action generally fare better than those that submit something that will not survive scrutiny. Never submit a vendor attestation letter as a risk analysis, and never backdate a document — that converts a compliance problem into a false statement problem.

Question 5

Should we hire a lawyer?

Accepted Answer

For anything beyond a routine desk audit, engage healthcare counsel early, ideally before you submit anything. Counsel scopes what is responsive, preserves privilege over internal analysis, and stops you volunteering documents outside the request — over-disclosure is one of the most common ways a narrow investigation becomes a broad one. We work alongside your counsel, not in place of them.

Question 6

Can we fix problems after the letter arrives?

Accepted Answer

Yes, and you should. OCR weighs corrective action in settlement decisions, and remediation after notice is viewed far more favourably than none. Document it honestly with real dates. What you must never do is present newly written material as though it predated the request.

Question 7

How does an investigation usually end?

Accepted Answer

One of three ways: closed with no findings; technical assistance, meaning informal guidance and a closure letter with no penalty; or a Resolution Agreement with a corrective action plan and a monetary settlement, typically carrying one to three years of monitoring and reporting obligations.

OCR Investigations and Enforcement

7 questions on ocr investigations

Next steps

Other FAQ sections

How ready is your practice? Find out in 2 minutes.

Ready for a free HIPAA consultation?