The OCR Audit Preparation Kit
An OCR investigation opens with a letter and a 10-business-day clock. Practices that start assembling evidence when the letter arrives are the ones that end up in a Resolution Agreement. This kit is the evidence index, the timeline, and the response process our team runs on day one.
What's inside
The 23-item evidence index
Everything OCR routinely requests in an initial data request, in the order they ask for it, with the acceptable form of each item.
A day-by-day response timeline
What to do on days 1, 2, 3, 5, 8 and 10 of the response window, including when and how to request an extension without signalling weakness.
The four six-figure mistakes
Stale risk analysis, unencrypted portable devices, missing BAAs, and volunteering documents outside the scope of the request. All four are avoidable.
Evidence index template
The cross-referenced index format we submit with every response, so a reviewer can find each requested item without hunting through an unsorted archive.
Desk audit vs complaint vs compliance review
Three different processes with three different risk profiles. Knowing which one you are in changes how you respond.
Who it's for
- →Practices that have just received an OCR data request letter
- →Administrators who want the evidence assembled before a letter ever arrives
- →Compliance officers preparing for a payer or cyber-carrier assessment
- →Any practice that has reported a breach and expects follow-up
Table of contents
- →1. Know which process you are in
- →2. The 10-business-day response timeline
- →3. The 23-item evidence index
- →4. The four mistakes that cost six figures
- →5. The evidence index format
- →6. After you submit
- →Next steps