The first sign of OCR HIPAA enforcement is almost never a subpoena. It is a plain envelope from the U.S. Department of Health and Human Services, Office for Civil Rights, addressed to whoever your practice listed as the contact on a breach report — or to "Privacy Officer" if OCR could not find a name. Inside is a data request with a response deadline, usually 30 days, sometimes less.

This article is for the person who has to answer that letter: the practice owner, administrator, privacy officer, or compliance lead. It covers how OCR cases actually start, what investigators ask for first, who at your practice has to produce it, and which documents must already exist because you cannot credibly backdate them.

What Triggers an OCR HIPAA Enforcement Investigation?

OCR opens HIPAA cases through three doors:

  1. A complaint. A patient, former employee, or competitor files a complaint. It must generally be filed within 180 days of when the person knew or should have known about the violation, though OCR can waive that for good cause.
  2. A breach report you filed yourself. Breaches affecting 500 or more individuals go to OCR within 60 days of discovery and land on the public breach portal. OCR reviews every one of them.
  3. A compliance review OCR initiates on its own. Triggered by news coverage, a pattern of smaller breaches, a referral from another agency, or a targeted enforcement initiative.

Most cases against small and mid-sized practices come through doors one and two. The complaint is usually about records access or a disclosure at the front desk. The breach report is usually about a lost laptop, a misdirected fax or portal message, an email account compromise, or a vendor's ransomware event.

The Complaint Path: Records Access Is Still the Fastest Way to Get Investigated

OCR launched its Right of Access Initiative in 2019 and has resolved dozens of cases under it — the majority against small providers, including solo practices, dental offices, psychiatry practices, and small specialty groups. Settlement amounts in these cases have frequently landed in the four- and five-figure range, which is exactly why they are worth your attention. They are not headline breaches. They are ordinary front-office failures.

The rule is simple and the clock is short. When a patient or their personal representative requests their designated record set, you have 30 calendar days to act, with one permitted 30-day extension if you notify the patient in writing of the reason and the new date. You may charge a reasonable, cost-based fee. You may not condition access on payment of an unrelated bill, and you may not refuse because the request came by email.

The Evidence OCR Wants on an Access Complaint

If a records complaint reaches you, OCR will ask for a narrative and then for proof. The proof looks like this:

  • A dated log of the request: when it arrived, in what form, who received it
  • Your written policy on individual access, including the fee schedule and how it was calculated
  • The response you sent, with the date and delivery method
  • If you extended, the written extension notice and the date it went out
  • Training records showing the staff member who handled it had been trained on access requests

If your front desk handles requests by memory and sticky notes, you will fail this test even when you actually sent the records. Build a request log this quarter. One row per request, five columns, kept for six years.

The Breach Path: Your Own Report Starts the Investigation

Every breach affecting 500 or more individuals is posted on the OCR breach reporting portal, and the portal is a useful reality check for any administrator. Filter by your state and your entity type. You will see the same categories repeating: hacking and IT incidents involving network servers and email, and unauthorized access or disclosure. Business associates account for a substantial share of the individuals affected.

Breaches affecting fewer than 500 individuals still get reported — annually, within 60 days after the close of the calendar year. That deadline for 2025 incidents falls on March 1, 2026. Practices routinely miss it because nobody owns the annual filing. Assign it now, by name.

Once a 500+ report is filed, expect a data request. OCR will not limit itself to the incident. The letter will ask about the incident, and then it will ask for your entire compliance program.

What OCR Actually Asks For in the First Data Request

The specific list varies, but across breach investigations and compliance reviews the core demands are consistent:

  • Your most recent security risk analysis, with the date it was conducted and the scope — every system, location, and medium where ePHI lives
  • Your risk management plan: the remediation actions chosen for each identified risk, who owns them, and completion dates
  • Written policies and procedures for the Privacy, Security, and Breach Notification Rules, with version dates and evidence of review
  • Business associate agreements for every vendor that touched the affected data, plus your full vendor inventory
  • Workforce training records: who was trained, on what, when, and how you documented completion
  • Access management evidence: user account lists, termination procedures, and proof that departed employees lost access
  • Audit log and activity review evidence showing you actually examine system activity rather than merely enabling logging
  • Encryption status for laptops, mobile devices, servers, and backups, or a documented rationale for an equivalent alternative measure
  • Contingency plan, including data backup, disaster recovery, and emergency mode operation, with test results
  • Sanction policy and any sanctions applied

Read that list again and ask a blunt question: if the request arrived Monday, could you produce all of it by mid-January? For most practices the honest answer is no, and the gap is almost always the same two items — a current, scoped risk analysis and a policy set that matches how the practice actually operates.

Why the Risk Analysis Is the Center of Gravity in OCR HIPAA Enforcement

The Security Rule requires an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI your organization creates, receives, maintains, or transmits. That is 45 CFR 164.308(a)(1)(ii)(A), and it is the single most frequently cited failure in resolution agreements.

OCR has made this explicit. In late 2024 the agency announced an enforcement initiative focused specifically on the risk analysis requirement, and subsequent settlements have repeatedly cited a missing, stale, or under-scoped risk analysis as the root finding. Meanwhile, the proposed Security Rule overhaul published in January 2025 would tighten these expectations further — more prescriptive requirements, fewer "addressable" escape hatches. That rule was not final as of December 2025, but the direction of travel is unmistakable.

Three failures show up over and over:

Scope That Stops at the EHR

Your risk analysis has to cover every location ePHI lives. Cloud storage. Email. The billing system. Text messages on personal phones. The scanner that keeps a copy on its internal drive. The satellite office. The remote coder's home laptop. If your assessment covers only the clinical system, it is not accurate and thorough.

Confusing a Vendor Checklist With a Risk Analysis

A security questionnaire from your IT provider is not a risk analysis. HHS and NIST both describe the required elements: identify assets and data flows, identify threats and vulnerabilities, assess current security measures, determine likelihood and impact, assign risk levels, and document the results. NIST Special Publication 800-66 Revision 2 is the reference OCR investigators point to, and HHS maintains its own risk analysis guidance.

No Follow-Through

A risk analysis that identifies fifteen risks and produces no remediation plan is worse than none at all — it documents that you knew. Risk management under 164.308(a)(1)(ii)(B) requires you to reduce risks to a reasonable and appropriate level. Every identified risk needs an owner, an action, and a date.

If your last risk analysis predates your current EHR, your telehealth setup, or your remote staff, it is evidence against you. Practices that need to close that gap quickly can generate a scoped risk analysis and the supporting policy set rather than assembling it from templates that never quite match the practice. What matters to an investigator is that the document is current, specific to your environment, and paired with a dated remediation plan.

Business Associate Agreements: The Cheapest Finding to Avoid

OCR has settled cases where the central failure was simply the absence of a signed BAA before PHI was disclosed. This is the easiest finding in the world to prevent and the hardest to explain away, because the agreement either exists with a date preceding the disclosure or it does not.

Build a vendor inventory with four columns: vendor name, what PHI they touch, BAA signed date, and contract renewal date. Include the ones people forget — shredding services, answering services, transcription, billing companies, IT managed service providers, cloud backup, patient communication platforms, and any AI documentation tool. If a vendor creates, receives, maintains, or transmits PHI on your behalf, you need an agreement. Practices that discover gaps mid-audit can produce a signature-ready business associate agreement quickly, but the fix only helps prospectively — sign before the data moves.

Penalties, Corrective Action Plans, and What Actually Happens

Most OCR investigations do not end in a monetary settlement. They end in technical assistance — OCR explains what you did wrong, you fix it, the file closes. That is the realistic outcome for a practice that responds promptly, produces real documentation, and demonstrates corrective action.

Where money is involved, civil monetary penalties follow a four-tier structure based on culpability, from lack of knowledge through willful neglect that was not corrected. The dollar amounts and annual caps are adjusted for inflation each year; check the current figures on the HHS enforcement pages rather than relying on numbers in any article, including this one. The largest HIPAA settlement on record remains the $16 million Anthem resolution from 2018, an outlier tied to a breach affecting tens of millions.

The part practices underestimate is the corrective action plan. Settlements typically include one to three years of monitoring: revised policies submitted for OCR approval, a new risk analysis, workforce retraining, and periodic reports. The administrative cost of a multi-year CAP often exceeds the settlement figure.

Recognized Security Practices Can Reduce Your Exposure

A 2021 amendment to the HITECH Act requires HHS to consider whether a regulated entity had recognized security practices — such as the NIST Cybersecurity Framework or practices developed under Section 405(d) of the Cybersecurity Act of 2015 — in place for the prior 12 months when determining penalties, audit outcomes, and remedies. This is a real mitigating factor, and it only counts if you can document 12 months of continuous adoption. That means dated policies, dated training, dated evidence. Start the clock before you need it.

Your 30-Day Readiness Sprint

Week 1 — Assign ownership. Name the privacy officer and security officer in writing. One person can hold both roles in a small practice, but the designation must be documented and current. Confirm who receives OCR correspondence and where mail from HHS goes.

Week 2 — Inventory. List every system, device, and location holding ePHI. List every vendor and its BAA status. Pull your user account list and confirm every departed employee is deactivated.

Week 3 — Risk analysis and remediation plan. Complete or refresh the assessment across the full inventory. Attach owners and dates to every identified risk.

Week 4 — Documentation and drill. Confirm policies exist, are dated, and reflect actual practice. Confirm training records for every workforce member hired in the past year. Then run a tabletop: pretend a data request arrived, and time how long it takes to produce five items from the list above.

Retention is six years from creation or last effective date, whichever is later. Store it where a successor can find it.

Start With the Document OCR Asks For First

Every investigation path — complaint, self-reported breach, or compliance review — converges on the same request: show me your risk analysis, your risk management plan, and your policies. If those three artifacts are current and specific to your practice, the rest of the response is manageable. If they are not, everything else you say sounds like improvisation.

If you are rebuilding from a stale binder or starting from nothing, produce a current risk analysis and the full HIPAA document set for your practice and give yourself a dated baseline. Then put next year's review on the calendar before you close this tab.