What an OCR investigation actually looks like, from the letter to the corrective action plan

OCR doesn't pick practices at random. As of its last published figures, the office had received more than 374,000 complaints since 2003, and complaints remain the main doorway. The others:

• A complaint, from a patient, an ex-employee, a competitor or a business associate's client. Anyone can file within 180 days of learning of the issue, and OCR reviews every one for jurisdiction.
• A breach report, which you file yourself. Reports of 500 or more people are investigated as a matter of routine. Smaller ones can be.
• A compliance review OCR opens on its own, often after a news story or a referral from a state attorney general.

OCR's formal audit program went dormant after the 2016 and 2017 round. HHS's inspector general criticized that in November 2024, and OCR began a small third round of about 50 Security Rule audits in December 2024. Investigations, not audits, remain what happen to practices.

The notification letter names the complaint or breach, cites the provisions OCR thinks may be involved, and attaches a data request with a deadline, commonly around 30 days. Covered entities and business associates are required by law to cooperate. The request is the whole investigation in miniature: if you can produce current, dated documents that match your practice, the matter tends to close. If you can't, the gaps become the findings.

Order the list the way an investigator reads it. Drag to reorder is overkill; click each to see what "current" means for it.

The letter doesn't ask whether you're secure. It asks whether you can prove it, on paper, by a date.Your engineer

1. Review. An investigator reads what you sent, follows up with questions, and may interview staff or request more. This is the long part: months is normal, and multi-year cases are not unusual.
2. Resolution without payment. Most investigations end here, with technical assistance, a letter of findings, or voluntary corrective action you agree to and report on. By HHS's count, over 31,000 cases have closed this way, against fewer than 200 with money attached.
3. Resolution agreement. Where OCR finds significant failures, especially a missing risk analysis after a breach, it proposes a settlement: a payment and a corrective action plan. The amount reflects the violations, your size and ability to pay, and your cooperation. Recent settlements with small practices have ranged from $5,000 to $140,000.
4. Civil money penalty. If no agreement is reached, OCR can impose a penalty under the four tiers, which you can contest before an administrative law judge. Rare, and usually larger.
5. Referral. Knowing misuse of PHI goes to the Department of Justice. State attorneys general can bring their own HIPAA actions.

Every settlement comes with one. A typical plan requires a new enterprise-wide risk analysis submitted to OCR for approval, a risk management plan, revised policies distributed and acknowledged by all staff, training with certification, reporting of workforce violations, and annual reports, all monitored by OCR for one to three years. Recent plans have run two years; a dental software vendor's 2026 plan runs three. The monitoring, the outside help to meet it, and the management time usually cost more than the settlement figure.

1. Have the ten documents. Current, dated, and matching reality. See what OCR asks for first.
2. Know your discovery dates. Breach timelines are checked against the calendar.
3. Keep the incident log honest. An incident you logged, assessed and closed is a strength. One that surfaces from a complaint is a finding.
4. Answer the letter completely and on time. Ask for an extension before the deadline if you need one, not after.
5. Get counsel for anything with a settlement attached. Terms are negotiable; the risk analysis isn't.