HIPAA audits and OCR investigations: what triggers them

How HIPAA audits and OCR investigations work for a Security Rule review

There is no HIPAA certificate. The HHS Office for Civil Rights (OCR) reviews Security Rule compliance through complaint investigations, compliance reviews and audits, and no private certificate changes that. The covered entity or business associate owns its controls, an implementation partner can prepare systems and evidence, and only OCR, or an independent assessor you have engaged for your own purposes, reaches conclusions about whether the safeguards work. The answer to what a review will look like depends on two things: how the review was triggered and what your risk analysis shows. A complaint, a breach report, a compliance review and an audit each open a different file, and the first document OCR typically asks for is the risk analysis. The trigger determines the scope. Under 45 CFR 160.306, anyone may file a written complaint within 180 days of when they knew or should have known of the act, unless that period is waived for good cause. OCR must investigate when a preliminary review indicates possible willful neglect and may investigate other complaints at its discretion. Under 45 CFR 160.310, you must keep records, cooperate, and give HHS access to facilities, records and PHI during business hours, or at any time without notice in exigent circumstances. Ask counsel now who receives and logs these requests, who owns the response calendar, and where the current risk analysis, policies and access reviews are stored so they can be produced quickly and consistently. The outcome also depends on the file. When noncompliance is indicated, OCR may resolve the matter informally through demonstrated compliance or a corrective action plan under 45 CFR 160.312. If informal resolution fails, the matter can move to a resolution agreement, generally with three years of reporting and possibly a payment, or to civil money penalties. Recent settlements, such as the OSF HealthCare and Ambry Genetics matters, cited inaccurate or missing risk analyses, delayed termination of departing workforce access and weak unique user identification. Before any review, confirm with your security official which of these items you can evidence for the prior 12 months, since OCR must consider recognized security practices shown for that period under the 2021 HITECH amendment.

What starts an OCR review of HIPAA Security Rule compliance

OCR rarely opens a Security Rule review without a trigger. Most reviews begin with a complaint, a breach report, a preliminary finding of willful neglect or one of the scheduled audits, and each route leads investigators to the same first request: proof that the risk analysis was accurate and kept current.

Individual complaints

Anyone who believes a covered entity or business associate is not complying can file a written complaint with HHS. The complaint must be filed within 180 days of when the person knew or should have known of the act, unless HHS waives that limit for good cause. Check whether your workforce, patients and vendors know how to escalate concerns internally, because a complaint you learn about from OCR leaves less room to respond first.

Compliance reviews after breaches or willful neglect

HHS must investigate a complaint and conduct a compliance review when a preliminary review indicates a possible violation due to willful neglect. It may review or investigate in other cases. Breach reports sent to OCR are a common trigger, so the security incident response file, the risk analysis and the documented remediation should be ready before a report is filed.

The 2024 to 2025 HIPAA audit program

HITECH requires periodic audits, and OCR's 2024 to 2025 audits review 50 covered entities and business associates on Security Rule provisions most relevant to hacking and ransomware. Selection is not a finding of fault, but an audited entity must produce evidence on demand. Confirm now that you can produce current risk analysis, access logs and contingency plans quickly, since OCR will publish an industry report after the audits conclude.

Investigations that follow a breach report

Many investigations start from a breach report. In the OSF HealthCare resolution agreement (July 29, 2026), OCR opened its inquiry after a 2021 report of a ransomware attack affecting 53,907 patients and cited failure to conduct an accurate and thorough risk analysis. In the Ambry Genetics settlement (September 17, 2026, $700,000), OCR cited risk analysis gaps, late termination of access for departing workforce members and missing unique user identification. Both are past resolutions, and both show the same pattern: the breach exposes what the risk analysis missed.

Access termination and unique user identification

The Ambry settlement shows that OCR reviews identity controls as closely as network defenses. Investigators look for documented procedures that remove access when a workforce member leaves or changes role, and for unique user IDs that tie each action in an ePHI system to one person. Test these with a sample of recent leavers and shared accounts before an inquiry does it for you.

Recognized security practices in the look-back

Under the 2021 HITECH amendment, OCR must consider, in certain enforcement and audit activities, whether recognized security practices were in place for the prior 12 months. Entities that can show a documented, operating program for those months are in a stronger position when OCR weighs remedies. Ask your security lead to confirm which practices are documented, who owns them and whether the evidence covers the full look-back period.

What investigators request and why the risk analysis comes first

Covered entities and business associates must keep records, cooperate with HHS investigations, and give HHS access to facilities, records and protected health information during business hours, or at any time without notice in exigent circumstances (45 CFR 160.310). That duty applies whether the inquiry comes from a complaint, a compliance review opened after a breach report, or one of OCR's HIPAA audits. In practice, the first request in most Security Rule matters is for the current risk analysis, because OCR treats it as the foundation for every other safeguard. Investigators then ask for the risk management plan showing how identified risks were reduced to a reasonable and appropriate level, and for evidence that the plan was acted on, not only written down. The requests that recur across OCR's recent settlements follow a predictable pattern. Expect questions on how access is terminated when workforce members leave, whether each user has a unique user identification, how audit controls record activity on systems holding ePHI, and whether that activity is reviewed on a set schedule. Investigators also ask for role-specific training records. Build a folder for each item now: the risk analysis and its update history, termination tickets with dates, user account listings tied to named individuals, audit log review records, and training rosters. Where a system is outsourced, confirm who holds each record and whether your business associate agreement obliges the vendor to produce it. The HITECH amendment on recognized security practices requires OCR to consider, in certain enforcement and audit activities, whether an entity had such practices in place for the prior 12 months, so documented practice over time matters as much as a single snapshot. Confirm the exact document list, format and deadlines with OCR's published audit protocol and with your own counsel before responding to any request, since the scope of each request depends on the matter.

How an OCR case moves from complaint to resolution

The sequence turns an allegation or breach report into a documented finding, and each phase produces a record that shapes the outcome. Knowing the order helps covered entities and business associates prepare evidence before OCR asks for it.

Receive the complaint or breach report
A case usually starts when someone files a written complaint with HHS, or when a covered entity reports a breach affecting 500 or more individuals. Under 45 CFR 160.306, a complaint must be filed within 180 days of when the complainant knew or should have known of the act, unless HHS waives that limit for good cause. OCR logs the matter and confirms it is in scope. The output is an open file with a case number and an initial description of the alleged problem.
Complete the preliminary review
OCR staff review the allegations and any breach report against the Security Rule to decide whether a possible violation exists. HHS must investigate a complaint, and must conduct a compliance review, when the preliminary review indicates a possible violation due to willful neglect. In other cases HHS may still choose to investigate or review, so the decision is discretionary. The output is a determination to open an investigation or a compliance review, or to close the matter with no further action.
Open the investigation or compliance review
OCR notifies the covered entity or business associate and begins fact gathering. A compliance review is a broader examination, while a complaint investigation focuses on the specific allegation, though both can reach the same Security Rule topics. The organization's job at this stage is to preserve records and identify a point of contact who can answer for the security program. The output is an established case file with a defined scope.
Respond to data requests and access demands
OCR sends written data requests, typically for the risk analysis, risk management plan, written policies, training records, access logs, business associate agreements and incident documentation. Under 45 CFR 160.310, entities must keep records, cooperate, and give HHS access to facilities, records and PHI during business hours, or at any time without notice in exigent circumstances. Responses should show what was done and when, not what was intended. The output is a documented production set that matches the requests, with gaps explained rather than hidden.
Document findings of noncompliance or compliance
Investigators compare the evidence with the Security Rule standards and implementation specifications, and they note where the entity met a requirement and where it did not. OCR's recent enforcement record shows that risk analysis failures, late access termination and missing unique user identification are common findings. Entities should expect that a certification or private attestation will not by itself answer a finding, because HHS does not recognize such certifications. The output is a set of preliminary findings that the entity can review and address.
Resolve informally through demonstrated compliance
When noncompliance is indicated, HHS may resolve the matter informally under 45 CFR 160.312, including through demonstrated compliance or a corrective action plan. The entity shows that it has fixed the problem or commits to a plan with specific steps. OCR reviews the evidence and decides whether the matter is closed. The output is a closure letter or an agreed corrective action plan that OCR accepts.
Sign a resolution agreement when informal resolution is not reached
A resolution agreement is a settlement in which the entity accepts specific obligations and reports to HHS, generally for three years, and it may include a payment. OCR's recent settlements have recommended mapping where ePHI enters, flows and leaves systems, periodic risk analysis and management, audit controls, encryption where appropriate, and role-specific training. The entity should ask counsel to review the obligations before signing, since they bind operations for the full term. The output is a signed agreement and a schedule of compliance reports.
Impose civil money penalties if resolution fails
If informal resolution fails, HHS may impose civil money penalties under the tiered amounts in 45 CFR 102.3, which are set by culpability. The penalty amount depends on the level of knowledge and whether the violation was corrected. Entities that want to limit exposure should confirm current amounts and their own culpability position with counsel. The output is a penalty determination that the entity may contest through the process HHS provides.

How OCR cases end and what each outcome requires

This table compares the three ways an OCR Security Rule investigation can end: informal resolution, a resolution agreement and civil money penalties. Read each column for who pays, what runs for years afterward and what evidence OCR expects. The main takeaway is that the earlier outcomes still depend on the same documented risk analysis and fixes.

Outcome	What it involves	Who pays and what continues	Evidence OCR expects
Informal resolution	OCR resolves the matter through demonstrated compliance or a corrective action plan under 45 CFR 160.312, without a formal settlement.	The entity bears its own remediation cost. No settlement payment is listed in the supplied facts, and obligations end once OCR accepts the corrections.	Proof that deficiencies are fixed, such as updated risk analysis, revised policies and training records, and a corrective action plan with dates.
Resolution agreement	A settlement in which the entity agrees to obligations and reports to HHS, generally for three years. It may include a payment, as in the Ambry Genetics settlement of $700,000.	The entity pays any settlement amount and funds the monitoring obligations. Reporting and compliance duties run for about three years.	Revised risk analysis and risk management plan, access termination records, unique user identification, audit control reviews and periodic reports to HHS.
Civil money penalty	Imposed when informal resolution fails. Under 45 CFR 102.3 the inflation-adjusted range for penalties assessed on or after January 28, 2026 is $145 to $2,190,294 per violation, with an annual cap of $2,190,294.	The entity pays the penalty. Amounts depend on culpability tier and violation count, so the total can be far above a settlement. Confirm current tiers with counsel.	The entity must contest or accept the findings through the formal process, and its prior documentation of risk analysis and safeguards becomes the central evidence.

How to prepare for an audit or investigation by role

The compliance lead owns the evidence index: a single map from each Security Rule standard and implementation specification to the document, record or system output that supports it. OCR's investigators typically ask for the risk analysis first, so that document needs to be current, dated and linked to the systems it describes. The organization owns every control and every policy in this set. An implementation partner can help structure the index and draft materials, but it does not issue findings, and the organization must be able to stand behind each statement it makes to HHS.

Evidence index: One register that maps each standard to its policy, procedure, record and owner, with a last-reviewed date for each entry.
Risk analysis currency: Confirm the analysis covers the current ePHI inventory, lists threats and vulnerabilities, and records the risk management plan and its progress.
Policy set: Check that written policies match how systems actually behave, including workforce access, training, sanctions, contingency planning and business associate agreements.
Documentation retention: Confirm that required documentation is kept for six years and is available to the people who must produce it.
Business associate files: Pull the signed agreements and the subcontractor chain for every vendor that touches ePHI.

Before any request arrives, walk the index with someone who was not involved in writing it and confirm every link opens to a current document.

What must be in place before a review arrives

Recent OCR settlements repeat the same gaps: a risk analysis that is not accurate or thorough, access that outlives employment, and no record of who did what. The cards below cover the items OCR recommends in those cases, and each one says what to check before an investigator asks.

Current risk analysis and management plan

OCR's first request in most investigations is the risk analysis, and the OSF HealthCare case cited a failure to conduct an accurate and thorough one after a ransomware breach. Check that the analysis covers all ePHI, is dated after your most recent system or vendor change, and is paired with a risk management plan that assigns owners and due dates to each identified risk. A document that was written once and never revisited is the finding to avoid.

Map of where ePHI enters, flows and leaves

OCR's recent settlements recommend mapping every point where ePHI is created, received, stored, transmitted or deleted, including vendor and cloud paths. Without this map, the risk analysis tends to miss shadow systems such as exported spreadsheets, email relays and backup copies. Check the map against your asset inventory and confirm that each system on it appears in the risk analysis.

Documented access termination

The Ambry Genetics settlement cited failures to end system access for workforce members who had left. For an investigator, the question is not only whether a policy exists but whether the timing can be shown. Check that HR departures, contractor end dates and role changes trigger access removal, and keep the ticket or log that proves each removal happened.

Unique user identification

Ambry Genetics was also cited for shared or non-unique user identification. Every person who touches ePHI should sign in with an individual account, so that an audit trail can name the actor. Check directory exports for generic or shared logins, service accounts with interactive use, and any administrative accounts that several staff members know.

Audit logs and regular activity review

Logs are only evidence if someone reviews them and the review leaves a record. OCR's recommendations call for audit controls and regular review of system activity. Confirm that authentication, access to ePHI and administrative changes are logged, that logs are retained and protected from editing, and that a named person signs off on reviews on a set schedule.

Encryption and role-specific training

OCR's recommendations also name encryption in transit and at rest where appropriate, and role-specific training. Where encryption is not used, the file should show the documented reason and an alternative measure, because the rule treats encryption as addressable. For training, check that clinicians, help desk staff, administrators and developers each have content tied to their access, with attendance records. Business associate agreements should be on file for every vendor that holds or can reach ePHI, so confirm that list is complete before the review starts.

Questions buyers ask about HIPAA audits and OCR investigations

Does a HIPAA certification protect us from an OCR audit?

No. HHS states that no Security Rule standard requires certification, that it does not endorse or recognize private organizations' certifications, and that a certification does not stop HHS from later finding a violation. An audit or investigation examines what your organization actually did, so the evidence matters more than any seal or certificate. Auditors and investigators request your risk analysis, policies, access records and activity logs, then test whether those records match daily operations. A vendor's certificate can start a conversation about its controls, but it cannot replace your own risk analysis or your own evidence of how ePHI is protected. Ask any vendor for the specific evidence behind a claim.

Can we prepare for an OCR audit without outside help?

Yes. Nothing in the Security Rule requires a consultant, and the covered entity or business associate owns its controls, policies and risk decisions. The rule does require an assigned security responsibility, and that role can be filled internally. Most teams start with the risk analysis, because OCR's recent enforcement record repeatedly cites inaccurate or incomplete analyses. HHS's free risk analysis tool and NIST SP 800-66 Rev. 2 are useful references, and NIST describes its guide as informational, not legally binding. Outside help usually fills specific gaps such as technical hardening, testing or documentation that staff lack time to produce. Assess your internal capacity honestly before deciding.

How long does an OCR investigation take, and what makes it longer?

No fixed duration applies, so the length depends on how the case started and how the organization responds. A complaint must generally be filed within 180 days of when the person knew or should have known of the act, unless HHS waives that limit for good cause. Many reviews begin after a breach report, and investigators then request records, ask for facility access and expect cooperation. Factors that lengthen a case include incomplete records, many affected systems, a preliminary finding of possible willful neglect and disputes over corrective action. Outcomes range from informal resolution, such as demonstrated compliance or a corrective action plan, to a resolution agreement with reporting generally for three years, to civil money penalties. Ask counsel to map your likely path early.

What do OCR investigators ask for during a Security Rule review?

Investigators first ask what the entity can show, then test whether practice matches the paperwork. Requests typically cover:

The current risk analysis and the risk management plan that followed it
Written policies, the assigned security official and training records
Access provisioning and termination records for workforce members
Audit logs and evidence of regular activity review for systems holding ePHI
Business associate agreements and vendor oversight files
Contingency plans and records of backup and restoration tests

The enforcement rules also require covered entities and business associates to keep records, cooperate with investigations and give HHS access to facilities, records and PHI during business hours, or at any time without notice in exigent circumstances.

What does an audit or investigation ask from our internal staff?

It asks for time from the people who run systems, manage access and handle personnel matters. The security official coordinates the response and owns the program. IT and engineering produce configuration evidence, log exports and system inventories showing where ePHI is stored and transmitted. HR and managers must show that departing workforce members lost access promptly, a failure cited in a recent settlement. Compliance or legal staff manage communications with HHS. Training and privacy staff document role-specific training and sanctions. Before a review starts, confirm who can sign responses and who can retrieve records within the deadlines in the request.

Can a consultant issue a HIPAA audit report or certificate?

No. Only an independent assessor or certification body can issue a third-party report, and HHS does not recognize private HIPAA certificates. OCR issues the outcome of its own investigations, such as a resolution agreement, but that is a government enforcement action, not a compliance attestation an organization can purchase. DeployOpen prepares systems, controls and evidence for assessment, and it does not issue audit reports, attestations or certifications. A readiness engagement can help you find gaps, document decisions and assemble evidence, while the organization still owns its controls and risk decisions. Ask any consultant in writing what it will deliver, who signs it and whether the work is a readiness review or an assessment.

What does a HIPAA readiness engagement cost, and what drives the price?

DeployOpen does not publish a price list, and a quote follows from the written scope. The main drivers are the number and type of systems holding ePHI, whether they run in your cloud accounts or on-premises, how many business associates and data interfaces need review, the condition of existing documentation, the number of technical gaps to remediate and whether security testing is included. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Costs split into one-time work, such as the initial risk analysis, remediation and evidence collection, and recurring work, such as retainers for upgrades, backups and continuous testing. Ask for line items, assumptions, exclusions and how scope changes are priced, then compare quotes on identical scope.

Which findings do recent OCR settlements cite most often?

Recent settlements cite a small set of recurring gaps. The Ambry Genetics settlement, announced September 17, 2026 at $700,000, cited failures in risk analysis, termination of access for departing workforce members and unique user identification. The OSF HealthCare case began with a 2021 breach report on a ransomware attack affecting 53,907 patients and cited a failure to conduct an accurate and thorough risk analysis. OCR's recommendations in these cases include mapping where ePHI enters, flows and leaves systems, periodic risk analysis and risk management, audit controls with regular activity review, encryption in transit and at rest when appropriate, and role-specific training. Use these findings as a checklist against your own environment, and confirm current OCR guidance before relying on any single case. Read the Ambry Genetics press release

How to choose a HIPAA assessor or readiness partner

HIPAA has no certification, so the outside party you hire should be chosen for what it can and cannot show. The checks below connect independence, relevant experience, the role of evidence preparation and a written scope, so you know who issues findings and who only helps you get ready for an OCR request or a third-party review.

Independence from the assessed system

Ask whether the firm will build, operate or administer any part of the systems it later reviews. A party that configured the logging, access controls or backups it then tests has a conflict, and an OCR investigator will look at who did the work. Separate the roles in writing: the firm that prepares evidence should not also be the one judging whether your safeguards meet the Security Rule.

Documented Security Rule experience

Ask for examples of work on the Security Rule specifically, not general security reviews. Good answers name the standards they have tested, such as risk analysis under 45 CFR 164.308, audit controls under 164.312 and business associate contracts under 164.314, and they can explain how they used HHS guidance and NIST SP 800-66 Rev. 2. Ask who on the team has done this work and whether they will be the people in the room.

Preparation versus findings

Confirm that the partner prepares systems, controls and evidence, and that only an independent auditor, assessor or certification body issues a report or attestation. HHS does not recognize private HIPAA certificates, and a seal from a vendor does not stop OCR from later finding a violation. Any firm that promises a HIPAA certificate, seal or "compliant" stamp should be treated with caution.

Fixed written scope

Require a written scope that names the systems, facilities, business units and ePHI flows covered, the deliverables and the dates. The scope should state what is excluded, such as cloud accounts you manage yourself or subcontractors that handle ePHI. Ask how changes to scope are priced and approved, since an unclear boundary is a common source of cost overruns and gaps in evidence.

Evidence the partner will hand over

Ask what artifacts you will own at the end: the risk analysis, the risk management plan, written policies, training records, access review logs and six-year documentation. Confirm that these stay in your environment and that you can show them to OCR yourself. Ask whether the firm has supported any OCR data request or breach report before, and how it would help you respond to one within the time OCR sets.

Questions to ask before signing

Before signing, ask who your named contact is, what happens if a finding turns out to be wrong, how confidential PHI in samples is handled, and whether the firm will sign a business associate agreement with you if it touches ePHI. Ask which parts of the work are one-time and which recur, and what a quote covers. Request written answers so the scope and responsibilities can be checked later.

Why audits stall and how to avoid it

Audits stall first at the risk analysis, because every later request depends on it. OCR's recent settlements cite risk analyses that were never done or were too generic to show how a specific system could be compromised. The fastest fix is an inventory that maps where ePHI is created, received, stored, transmitted and deleted, including SaaS tools, backups, laptops and personal devices. Investigators ask for data flows before they ask for policies, and without that map the team cannot scope the analysis. Every question about a system then takes days to answer and the request list grows. Confirm the date of the last risk analysis, whether it names each system, and whether the risk management decisions it produced were carried out. OCR's recommendations to map ePHI flows and to repeat the risk analysis on a schedule show the sequence to follow.

Undocumented decisions and missing access records cause the next delays. Implementation specifications are either required or addressable. For an addressable one, the entity must assess whether it is reasonable and appropriate, and if it is not, document why and implement an equivalent measure where reasonable (45 CFR 164.306(d)). When that reasoning lives only in someone's memory, the team must rebuild it under deadline, and an unexplained decision looks like an omission. Access termination is the other common gap. The Ambry Genetics settlement cited failures to end access for departing workforce members and to assign unique user identification. Investigators will therefore request termination records for a sample of leavers and the account lists that show who used which login. Reconcile those records against HR exit data and find any shared accounts before the request arrives.

How DeployOpen prepares Security Rule evidence for a review

DeployOpen prepares the systems, controls and evidence an organization would show during an OCR review, complaint investigation or audit. The organization owns its controls and its HIPAA compliance, and only OCR or its own independent assessor draws conclusions about them.

How we scope

Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
The written scope names which ePHI systems, applications and hosting environments are covered by the review preparation.
Scope also states which Security Rule standards the evidence set addresses, such as risk analysis, access control and audit controls.
Ongoing support after the review is available as a retainer, scoped separately from the initial work.

How we build

Systems holding ePHI are configured inside your own cloud accounts, data centers or air-gapped networks.
Audit logging, access review records and user identification are set up so activity can be reconstructed for an investigator.
Encryption, backup and restoration settings are checked against the risk analysis and documented decisions for each system.
Security testing of applications, APIs and infrastructure can be run to produce findings your team can act on before a review.

How we hand over

Deliverables include configuration records, evidence logs and documentation mapped to the Security Rule standards in scope.
Evidence packages are organized so your security official can produce records for an OCR information request quickly.
Written handover covers how each system is operated, backed up, upgraded and monitored after the engagement ends.
Your team owns the final policies, risk analysis decisions and any statements made to OCR or an independent assessor.

How we support

Support retainers cover upgrades, patching and periodic re-checks of the evidence set as systems change.
Continuous security testing can be retained to refresh findings between audit cycles or after an incident.
Before engaging, ask your counsel and independent assessor to confirm which evidence they need for your specific review.
Ask for a written quote that lists the scope, deliverables, handover items and any retainer terms before work begins.