OCR Audit Program Guide for Healthcare

The OCR audit program is how HHS checks HIPAA compliance without waiting for a breach or complaint. In its 2016-2017 round, OCR picked entities at random from pools. It gave them 10 business days to send documents for a desk audit, a review done from OCR's office. Most of them failed risk analysis and risk management, so start there.

The OCR audit program is one of the ways the Department of Health and Human Services (HHS) Office for Civil Rights checks HIPAA compliance. It does not wait for a breach to start an investigation. Instead, it looks ahead. It checks whether covered entities and business associates keep the policies, procedures, and protections that federal law requires.

For healthcare practices of every size, it pays to know how OCR audits work. OCR runs audits in rounds, and the notice comes by email. In past rounds, you had 10 business days to send the records OCR asked for. Practices that prepare ahead are in a much better spot to show they comply. This guide explains how the OCR audit program works and what your practice can do to be ready.

How the OCR Audit Program Works

Origins and Legal Authority

The HITECH Act of 2009 requires HHS to audit covered entities and business associates from time to time. The audits check the HIPAA Privacy, Security, and Breach Notification Rules. OCR runs these audits. The audit program is separate from OCR’s complaint-driven investigations. So your practice can face an audit even if no breach or complaint has been filed.

OCR uses a written audit protocol. It is a list of audit questions. Each question is tied to a specific section of the HIPAA Rules. OCR posts the protocol on its website, so you can use it to check yourself. The program has changed over time. Each round has shown OCR where entities struggle.

Audit Selection Process

For its 2016-2017 audits, OCR first checked contact information for covered entities and business associates. Next, it sent a screening questionnaire about size, type, and operations. Then it sorted possible auditees into pools. It looked at:

• Entity size and type (hospitals, practitioners, health systems, pharmacies, health plans, clearinghouses, business associates).
• Affiliations and location, plus whether the entity was public or private.
• Current enforcement activity: OCR did not audit entities that already had an open complaint investigation or compliance review.
• Random selection from the pools. Any practice could be audited, no matter its history.

Each selected entity got a notice letter and a request for specific documents. The documents were due within 10 business days. HHS also said this: an entity that skipped OCR's contact check or screening questionnaire could still be picked for an audit. It could also face a compliance review (a formal OCR look into its compliance).

Audit Protocol Areas

The OCR audit protocol covers three rules:

• Privacy Rule requirements, including the Notice of Privacy Practices, patients' right to get their records, the minimum necessary standard (share only the PHI needed for the job), authorizations (a patient's written permission), and how PHI is used and shared.
• Security Rule requirements, including administrative, physical, and technical safeguards (protections), plus written policies and record-keeping.
• Breach Notification Rule requirements, including how you decide if something is a breach, how you send notices, and how you record your breach decisions.

Each area has specific audit questions tied to sections of the rules. Auditors check three things. Has the practice put required policies in place? Does the practice follow them? Is there enough written proof to show it?

Phase 1 and Phase 2 Audits

Phase 1: The Pilot Program

OCR launched Phase 1 of its audit program in 2011-2012 as a pilot effort. During Phase 1, OCR audited 115 covered entities. These were full audits with site visits. They looked at the Privacy, Security, and Breach Notification Rules.

OCR's later report says the 2012 audits found problems in two Security Rule areas:

• Risk analysis: finding the risks to the electronic PHI (ePHI) you hold.
• Risk management: putting security measures in place to lower those risks.

OCR used those results, along with its enforcement work, to choose which rules Phase 2 would check.

Phase 2: Desk Audits and Expanded Scope

Phase 2 ran in 2016 and 2017. In this round, OCR tested whether desk audits were useful and worth the cost. In a desk audit, OCR reviews the documents you send from its own office. OCR audited 166 covered entities and 41 business associates.

Phase 2 ran in this order:

1. Desk audits of covered entities came first, in 2016.
2. Desk audits of business associates followed in 2017.

OCR said it also planned in-person audits as a later step. Some desk auditees could get one. But its report on the 2016-2017 audits covers only the desk audits.

Phase 2 was also the first round to include business associates. That reflects the role vendors, contractors, and service providers play in handling health data.

Desk Audits vs. In-Person Audits

Understanding Desk Audits

Desk audits were the main audit tool in Phase 2. In a desk audit, OCR asks for specific documents from the audited entity. It reviews them from its own office. The audit looks at a limited number of rules, not every part of HIPAA.

In Phase 2, a desk audit went like this:

1. OCR sent a screening questionnaire about size, type, and operations to possible auditees.
2. OCR emailed a notice letter to each selected entity.
3. OCR asked for specific documents tied to the selected rules.
4. The entity uploaded the documents to OCR's secure online portal within 10 business days.
5. OCR auditors reviewed the documents and sent draft findings.
6. The entity had 10 business days to send written comments on the draft.
7. OCR finished the final audit report within 30 business days after the entity's response.

In 2016-2017, OCR checked each covered entity on one of two sets of rules. Some were checked on the Privacy and Breach Notification rules. Others were checked on the Security Rule. The privacy and breach audits looked at four things. They were the Notice of Privacy Practices, posting it on your website, patients' right to get their records, and the timing and content of breach notices. The security audits looked at risk analysis and risk management.

Understanding In-Person Audits

HHS says in-person audits check more rules than desk audits. OCR auditors visit the entity's offices to look at compliance in more depth. An in-person audit may include:

• Interviews with key staff including the Privacy Officer, Security Officer, and other team members.
• Observation of physical safeguards such as workstation security, building access controls, and how staff handle records.
• Review of technical systems including access controls, audit logs, encryption, and incident response procedures.
• Examination of training records to confirm that team members get required HIPAA training.
• Review of business associate management including your BAA list and vendor oversight practices.

HHS said some desk auditees might get a later in-person audit. It also said auditees should be ready for a site visit when OCR thinks one is needed.

Common OCR Audit Findings

Most Frequently Cited Gaps

OCR's audit reports point to some clear problem areas. The list below also includes other gaps that are common in HIPAA compliance work. Use it to decide where to look first.

Security Rule findings:

• Incomplete or missing risk analysis. OCR found problems here in Phase 1. In Phase 2, most auditees failed this requirement.
• Weak risk management plans that do not fix the weak spots you found. Most Phase 2 auditees failed this too.
• Missing or outdated policies and procedures for Security Rule administrative safeguards (the office rules and routines that protect PHI).
• Weak access controls, such as no unique user identification (a separate login for each person) and no automatic logoff.
• Lack of encryption for ePHI at rest and in transit.
• Incomplete audit logging and failure to regularly review audit logs.

Privacy Rule findings:

• Notice of Privacy Practices that leaves out required elements. Most covered entities in Phase 2 fell short here.
• Not following the minimum necessary standard when using or sharing PHI.
• Weak patient access procedures, such as not giving patients their records on time. In Phase 2, 89% of covered entities failed to show they met the right of access rules.
• Missing or incomplete authorization forms that lack required elements.
• Not enough staff training on Privacy Rule requirements.

Breach Notification Rule findings:

• Missing or incomplete process for deciding if something is a breach .
• Not writing down breach decisions, including the four-factor risk assessment (the four points the rule says to weigh).
• Breach notices missing required content. In Phase 2, 67% of covered entities failed to show they got this right. Most did meet the notice deadline.
• Incomplete breach log. For breaches that affect fewer than 500 people, keep a log or other records. Report them to HHS within 60 days after the calendar year ends (45 CFR 164.408(c)).

Fixing these common gaps before an audit is a good use of your time. For a deeper look at how penalties work, see our guide on HIPAA penalties and enforcement actions.

Preparing for an OCR Audit

Building a State of Continuous Readiness

The best audit prep is not a last-minute scramble. It is a continuous audit readiness program. It keeps your documents current and your daily work in line with your policies. These steps help:

Keep a current, thorough risk analysis. HIPAA requires an accurate and thorough risk analysis (45 CFR 164.308(a)(1)(ii)(A)). It was a top problem area in both audit phases.

Your risk analysis should list every system that creates, receives, stores, or sends ePHI. It should look at threats and weak spots for those systems. It should weigh how likely each risk is and how much harm it could do. It should also list the security measures you use to lower those risks.

The current rule does not set a yearly schedule. It says to review and update your security measures as needed (45 CFR 164.306(e)). A yearly check helps keep it current. So does an update whenever your systems change.

Keep a complete policy and procedure library. Each HIPAA requirement that applies to you should have a written policy and procedure. Review them from time to time and update them as needed (45 CFR 164.316(b)(2)(iii)). Keep a version history. Train staff on the policies that apply to them. Then write down that the training happened.

Put a risk management plan in place and write it down. Your plan should cover every major risk found in your risk analysis. For each risk, write down the fix you chose, the timeline, the person responsible, and where it stands now.

Set up a strong training program. Keep detailed training records. Include the date, the topics covered, the trainer, who attended, and signed acknowledgments. Train new staff within a reasonable time after they join. Train affected staff within a reasonable time after a material policy change, meaning one that affects their work (45 CFR 164.530(b)(2)). A yearly refresher for everyone also helps.

Document Categories OCR Typically Requests

When selected for an audit, OCR requests documents in specific categories. Knowing these categories in advance helps. You can gather and organize materials before the 10-business-day response window starts.

• Risk analysis and risk management: Your current risk analysis methodology, findings, risk register, and the risk management plan showing how identified risks are being addressed (45 CFR 164.308(a)(1)(ii)(A) and (B)).
• Policies and procedures: All HIPAA-related policies with version history, review dates, and evidence of workforce distribution.
• Workforce training: Training materials, attendance records, dates, topics covered, and acknowledgment documentation.
• Business Associate Agreements: Current BAA inventory with signed agreements for all vendors handling PHI.
• Access control documentation: User access lists, role-based access policies, procedures for granting and revoking access, and unique user identification records (45 CFR 164.312(a)(1)).
• Audit logs and review records: System activity logs for ePHI-containing systems and evidence of regular log review (45 CFR 164.312(b)).
• Incident response and breach records: Incident response plan, breach risk assessments, notification records, and breach log.
• Physical safeguard documentation: Facility security plans, workstation use policies, and device and media disposal records.
• Contingency planning: Data backup procedures, disaster recovery plan, and emergency mode operation plan (45 CFR 164.308(a)(7)).
• Sanction policy: Written sanction policy and records of any sanctions applied to workforce members (45 CFR 164.308(a)(1)(ii)(C)).
• Notice of Privacy Practices: Current NPP with distribution records and acknowledgment forms.

Documentation Requirements

OCR auditors rely heavily on written records to assess compliance. Your practice must be able to produce the following on short notice (all documentation must be retained for a minimum of six years per 45 CFR 164.530(j)):

• Current risk analysis with documentation of the method used.
• Risk management plan with the status of each fix.
• Complete HIPAA policies and procedures with revision history.
• Workforce training records including content, dates, and attendance.
• Business Associate Agreements for all vendors handling PHI.
• Breach notification documentation including risk assessments and copies of notices sent.
• Incident response records documenting security incidents and their resolution.
• System activity logs and audit trail reviews.
• Physical safeguard documentation including facility security plans.
• Sanction policy and records of any sanctions imposed.

Keeping your compliance documents in one place helps your practice respond quickly to audit requests. In the 2016-2017 audits, OCR rated each entity on the documents it sent. A practice that cannot find or produce its records cannot show compliance. For a broader view of what HIPAA requires, review our complete HIPAA compliance guide.

Developing a Corrective Action Plan

When OCR sends draft findings, you get a chance to respond. You can describe fixes you have made or plan to make. OCR includes your response in the final report. It helps to write those fixes down as a Corrective Action Plan (CAP). A CAP is a step-by-step plan to fix each gap. It keeps the work organized.

A good CAP should include:

• A clear description of each gap named in the audit report.
• Root cause analysis, which explains why the gap exists.
• Detailed fix steps with clear, measurable actions.
• Responsible parties assigned to each fix.
• Timeline with realistic but prompt deadlines.
• Verification method that explains how the practice will confirm each fix is done.
• Monitoring steps to keep the gap from coming back.

Fix gaps quickly and keep proof of the fixes. That puts your practice in a better spot if OCR looks again.

What Happens After an Audit

Audit Reports and Follow-Up

When its review is done, OCR sends draft findings to the audited entity. In Phase 2, the entity had 10 business days to review the draft and send written comments on the findings. OCR reads the entity’s response before it writes the final audit report.

The final audit report generally covers:

• How the audit was done and which rules were checked.
• The findings for each audited area. In 2016-2017, OCR rated each area on a 1 to 5 scale. A 1 meant full compliance. A 5 meant no evidence of a serious attempt to comply.
• Specific gaps found, with the rule section each one falls under.
• The entity’s response to the draft findings.

Escalation to Enforcement

HHS calls audits mainly a way to improve compliance, not a way to punish. But audit findings can lead to enforcement. If an audit report shows a serious compliance issue, OCR may open a compliance review to look further. A compliance review can lead to:

• A settlement through a Resolution Agreement. This usually includes a payment and a multi-year CAP.
• Civil money penalties (fines). The entity can ask for a hearing before an administrative law judge (45 CFR 160.504).

This link between audits and enforcement is why preparing ahead matters. Treat audit prep as an ongoing job. Practices that do are better protected from the most serious results. If an audit leads to a compliance review or enforcement action, knowing how to respond to a HIPAA complaint can help. Understanding the full scope of HIPAA enforcement helps practices see what is at stake.

OCR Audit FAQ

How often does OCR conduct audits?

OCR conducts audits in rounds rather than on a fixed annual schedule. The HITECH Act requires audits from time to time. OCR ran Phase 1 in 2011-2012 and Phase 2 in 2016-2017. HHS says its 2024-2025 round would review 50 covered entities and business associates. That round would check the Security Rule provisions most related to hacking and ransomware. There is no set schedule for individual practices, and any covered entity or business associate could be selected in any audit round.

Can business associates be audited?

Yes. Phase 2 of the OCR audit program expanded to include business associates. If your company handles PHI on behalf of a covered entity, you are subject to audit. This includes IT service providers, billing companies, cloud hosting providers, and any other vendor that creates, receives, maintains, or transmits PHI.

What is the difference between an OCR audit and an OCR investigation?

An OCR audit is a planned check of compliance. In Phase 2, auditees were picked at random from pools of entities. An OCR investigation usually starts with a complaint or a breach report. HHS calls audits mainly a way to improve compliance. But if an audit report shows a serious compliance issue, OCR may open a compliance review to look further.

How much time do we have to respond to an audit request?

In the 2016-2017 desk audits, entities had 10 business days to send the documents OCR asked for. That is a tight deadline. So keep your compliance records organized and easy to find. OCR rated each entity on the documents it sent. Records you cannot produce in time do not count in your favor.

Does passing an audit guarantee compliance?

No. An audit checks only selected rules, at one point in time. Passing means those areas met the requirements at that time. Compliance is an ongoing job. It takes steady effort, regular updates, and close tracking across all HIPAA rules.

OCR Audit Takeaways

The OCR audit program is a compliance challenge. It is also a chance to find your gaps. Practices that keep up with readiness, keep thorough records, and fix known gaps early are in the best position to get through an audit. Preparing ahead is far easier than dealing with bad findings, corrective action plans, and possible enforcement action.

One Guy Consulting offers the Full-Scope plan. It includes a Security Risk Assessment tool, policy and procedure templates, staff training and progress tracking, and audit-readiness prep. It also includes audit response support if an OCR letter arrives. Contact us to learn how it works. Document your risk assessment and run a gap analysis.

Sources

• HHS OCR Audit Program.
• HHS OCR Report on 2016-2017 HIPAA Audits.
• 45 CFR Part 164: Security and Privacy Rules.
• HHS OCR Enforcement Actions.
• 45 CFR 164.308: Administrative Safeguards.
• 45 CFR 164.530(j): Documentation Retention Requirements.

Compliance Program Resources

• HIPAA Audit-Proof Checklist.
• Healthcare Regulatory Compliance Guide.
• Building a Healthcare Compliance Culture.

Related: 2025 HIPAA enforcement actions · HIPAA documentation requirements