HIPAA OCR audits conducted by the Office for Civil Rights do not come with much warning. An organization selected for a desk audit may receive a data request with a response deadline of ten business days. An organization under investigation following a complaint or breach report may face document requests, interviews, and on-site reviews with limited time to prepare. Organizations that wait until they receive an OCR inquiry to start thinking about their documentation are already behind.

This article explains how OCR audits work, what auditors look for, which documentation gaps create the most exposure, and what steps covered entities and business associates can take now to put themselves in a defensible position.

How HIPAA OCR Audits Work

The Office for Civil Rights enforces HIPAA through two primary mechanisms: the audit program and complaint-driven investigations.

The OCR Audit Program. OCR is authorized under the HITECH Act to conduct periodic audits of covered entities and business associates to assess compliance with HIPAA Privacy, Security, and Breach Notification Rules. The audit program operates in phases and has included both desk audits and on-site audits. Desk audits are document reviews – OCR sends a request for specific documentation and evaluates compliance based on what the organization submits. On-site audits involve direct interviews with staff, review of physical facilities, and examination of technical controls in addition to documentation review.

Organizations selected for audit are typically notified by email. The notification identifies the organization as an audit subject, explains the process, and provides instructions for submitting documentation through OCR’s secure audit portal. Response deadlines are firm.

Complaint investigations. The more common trigger for OCR scrutiny is a complaint filed by a patient or workforce member, or a breach report submitted through the HHS breach notification portal. When OCR opens an investigation, it typically begins with a written request for documentation. If the documentation review reveals potential violations, OCR may escalate to a more formal investigation, request additional information, or initiate a resolution process that can result in corrective action plans, resolution agreements, and civil money penalties.

Both types of review follow a similar documentary logic. OCR is looking for evidence that your organization has implemented the policies, procedures, and controls required by HIPAA, that those policies have been communicated to your workforce, and that you have documentation to demonstrate all of the above.

What OCR Auditors Look For

OCR’s audit protocols are publicly available and cover Privacy Rule, Security Rule, and Breach Notification Rule requirements in detail. Understanding what auditors evaluate is the foundation of audit preparation. The following areas receive consistent focus across OCR audit and enforcement activity.

Security Risk Analysis. The single most frequently cited deficiency in OCR enforcement actions. Auditors will ask to see your completed risk analysis, review its scope and methodology, and assess whether it is current. A risk analysis that was completed once and never updated, that covers only your primary EHR system and not your full ePHI environment, or that lacks documented risk ratings and a corresponding risk management plan will draw significant scrutiny. No other documentation gap creates more enforcement exposure.

Privacy and Security policies. Auditors will request your written Privacy and Security policies and review them for completeness, regulatory alignment, and evidence that they have been implemented rather than just drafted. A policy that describes procedures your organization does not actually follow is worse than having no policy – it establishes a standard against which your actual practices will be measured.

Business Associate Agreements. Auditors frequently request a list of business associates and copies of executed BAAs – our Business Associate Agreement template gives you a ready-to-execute starting point. Organizations that cannot produce a complete inventory of their business associate relationships or that have vendors with PHI access and no BAA in place are at significant risk. OCR has assessed penalties specifically for missing BAAs in multiple enforcement actions.

Workforce training records. Both the Privacy Rule and Security Rule require documented workforce training. Auditors will ask for training records demonstrating that all workforce members received training on your privacy and security policies and the dates on which that training occurred. Verbal training without documentation does not satisfy the requirement.

Notice of Privacy Practices. Covered entities must have a current Notice of Privacy Practices that meets all regulatory requirements and must be able to demonstrate that it is being distributed to patients as required. Auditors will review the content of the notice and ask about distribution procedures.

Breach response documentation. For organizations that have experienced incidents, auditors will review incident and breach documentation to assess whether the organization followed its policies, conducted required risk assessments, met notification timelines, and documented outcomes. Missing or incomplete breach documentation following an incident significantly increases enforcement exposure.

Access controls and audit logs. On-site audits and technical investigations will examine whether your organization has implemented access controls limiting PHI access to authorized users, and whether audit logging is in place to record access to ePHI systems. Auditors may request samples of access logs and review how access is managed when workforce members change roles or leave the organization.

The Documentation OCR Will Request

Based on OCR’s published audit protocols and enforcement history, organizations should be prepared to produce the following documentation for a HIPAA OCR audit on short notice:

📋 Building your audit documentation package? Our HIPAA Compliance Essentials bundle gives you all the core policies, procedures, and forms OCR auditors expect to see – pre-drafted in Microsoft Word and organized for immediate use. Having your documentation ready before an audit request arrives is the single most effective way to manage the process.

Security Rule documentation: completed Security Risk Analysis with methodology, asset inventory, and risk register; Risk Management Plan describing how identified risks are being addressed; Information Security Policy; Access Control Policy; Audit Controls Policy; Workforce Security and Sanctions Policy; Security Incident Response Policy; Contingency Plan including backup and disaster recovery procedures; Device and Media Controls Policy; Facility Access Controls Policy; Transmission Security Policy; Security Awareness Training records with dates and attendees.

Privacy Rule documentation: HIPAA Privacy Policy; Uses and Disclosures Policy; Minimum Necessary Standard Policy; Patient Rights Policy and procedures; Notice of Privacy Practices with evidence of distribution; Privacy Officer designation; Business Associate Agreement inventory with copies of executed agreements; Privacy training records; Workforce Sanctions Policy; complaint log.

Breach Notification Rule documentation: incident log covering all reported incidents and their dispositions; breach risk assessments for incidents that required the four-factor analysis; notification records for any reportable breaches including copies of notifications sent to individuals and HHS; documentation of any corrective actions taken following a breach.

Building an Audit-Ready Compliance Program

Audit readiness is not a one-time project. It is the ongoing state of a compliance program that has the right documentation in place, keeps it current, and can produce it quickly when requested. The following steps build toward that state systematically.

Complete and document your Security Risk Analysis. If your organization has never completed a formal risk analysis, this is the starting point. If you have a risk analysis but it is more than a year old or predates significant changes to your environment, update it. The risk analysis is the foundation of your Security Rule compliance program and the first thing OCR will ask for. A current, well-documented risk analysis with a corresponding risk management plan demonstrates a functioning compliance program more effectively than any other single document.

Build a complete policy library. Every requirement in the OCR audit protocol should have a corresponding written policy. Audit the policies you have against the full list of what is required and identify gaps. Policies should be dated, version-controlled, and reviewed at least annually. An outdated policy that has never been reviewed since it was first written will raise questions about whether it reflects your current practices.

Inventory your business associate relationships. Build a spreadsheet or tracking document listing every vendor with access to PHI, the nature of their access, and whether a current, compliant BAA is in place. Review this list whenever you engage a new vendor. A missing BAA with a long-term vendor is exactly the kind of gap that surfaces during an audit and is difficult to explain after the fact.

Document your workforce training. Conduct annual HIPAA training for all workforce members and maintain records of who attended, when, and what was covered. New workforce members should receive training before they are given access to PHI. Training records should be retained for at least six years. If your current training program does not produce records you can produce on demand, fix that before your next training cycle.

Establish an incident intake process. Every potential privacy or security incident should be reported, logged, and evaluated using a consistent process. Organizations that have no formal incident intake process inevitably miss incidents that should have been investigated, assessed for breach notification requirements, and documented. An incident log with documented dispositions is evidence of a functioning compliance program.

Organize your documentation for rapid retrieval. When OCR sends a document request with a ten-day deadline, an organization that has to search through shared drives and email archives to find its policies is at a significant disadvantage. Maintaining a centralized, organized compliance documentation repository – whether a dedicated folder structure, a compliance management system, or a simple SharePoint site – means you can respond to a document request quickly and completely.

What Happens If OCR Finds Violations

When OCR identifies compliance deficiencies, the outcome depends on the nature and extent of the violations, the organization’s compliance history, and the degree of cooperation and good faith demonstrated during the review.

Minor deficiencies that are promptly corrected often result in technical assistance and a finding of voluntary compliance. More significant deficiencies typically result in a corrective action plan – a formal agreement with OCR specifying the steps the organization must take to achieve compliance, along with a monitoring period during which OCR verifies implementation.

Serious violations, particularly those involving willful neglect – a knowing or reckless disregard for the requirements of HIPAA – carry civil money penalties ranging from $10,000 to $50,000 per violation, with annual caps of $1.5 million per violation category. OCR has assessed penalties in this range against organizations that had no risk analysis, no written policies, and no workforce training in place.

The consistent pattern in OCR enforcement actions is that organizations with documented, implemented compliance programs – even imperfect ones – fare significantly better than organizations that cannot demonstrate any structured compliance effort. Good faith, documented corrective action, and cooperation with OCR’s review are all factors that influence outcomes. A compliance program that exists only on paper, however, provides no protection. Documentation must reflect actual practice.