How to Prepare for an OCR HIPAA Audit
OCR sends an initial data request with 10 business days to respond. Here's exactly what they ask for — and how to have it ready before you ever get the letter.
The 10-day rule
OCR investigations begin with a letter that gives you just 10 business days to produce policies, procedures, risk analyses, and evidence of implementation. Practices that scramble at this point almost always end up in a Resolution Agreement with a monetary settlement.
Documents to have on file today
If you can't produce every item on this list within 24 hours, you're not audit-ready.
- →Current Security Risk Analysis (dated within 12 months)
- →Written Security Rule policies covering all 54 implementation specifications
- →Written Privacy Rule policies including your Notice of Privacy Practices
- →Workforce training logs with signed attestations
- →Business Associate Agreements for every vendor
- →System access reviews (quarterly minimum)
- →Incident response plan and test evidence
- →Contingency / disaster recovery plan and test evidence
- →Sanctions policy and evidence of enforcement
Common six-figure mistakes
The most common OCR findings — and the ones that generate the largest settlements — are a missing or stale Security Risk Analysis, no encryption on portable devices, and Business Associate Agreements that were never signed. Every one of these is preventable in a single afternoon.