HIPAA Audits: What OCR Checks and How to Prepare

OCR investigations and compliance reviews typically request artefacts tied to the Security Rule, Privacy Rule, and Breach Notification Rule — not marketing slides. Prepare a response binder (physical or digital) before you receive a letter.

Related: HIPAA hub · Audit logs · Checklist.

Documentation retention — 45 CFR 164.316(b)(2): retain Security Rule documentation for 6 years from the date of creation or the date when it last was in effect, whichever is later. This covers policies, procedures, and related documentation — not a separate “6-year SIEM log retention” statute. Operational log retention is a risk-based practice supporting audit controls (164.312(b)).

Breach Notification Rule clocks — 45 CFR 164.400–414 (HITECH-based): Individuals: without unreasonable delay and in no case later than 60 calendar days after discovery (164.404). HHS for breaches affecting 500+ individuals: without unreasonable delay and no later than 60 calendar days after discovery (164.408). HHS for fewer than 500: not later than 60 days after the end of the calendar year in which the breach was discovered. Media: if 500+ residents of a State or jurisdiction, notify prominent media without unreasonable delay and no later than 60 days (164.406). Business associates must notify the covered entity without unreasonable delay and no later than 60 days after discovery (164.410).

What OCR Commonly Requests

Risk analysis and risk management documentation (§164.308(a)(1))
Policies/procedures and evidence they were in effect (6-year documentation retention)
Workforce training records
BAAs and BA inventory
Access control / authentication evidence and audit-log samples (§164.312)
Incident and breach investigation files with notification timelines

30-Day Prep Sprint

Refresh asset inventory and risk analysis sign-off
Export BA register and confirm every active BA has a BAA
Pull sample audit logs for EHR, IdP, and admin access
Verify breach notification playbooks match 164.400–414 clocks
Stage evidence URLs in CSA

How CyberSilo Helps

CSA packages control-to-evidence matrices for investigator requests
ThreatHawk produces searchable access timelines for §164.312(b)

Be Ready Before the Letter Arrives

Keep risk analyses, BAAs, and audit trails exportable on demand.

Talk to CyberSilo HIPAA Automation

Frequently Asked Questions

Does OCR only audit large hospitals?

OCR investigates complaints, breach reports, and compliance reviews across covered entities and business associates of many sizes.

What is the fastest evidence win?

A current signed risk analysis, complete BAA set, and demonstrable audit logging for ePHI systems.

How do breach clocks matter in an audit?

Investigators examine whether notifications met 164.404–410 timelines after discovery.

HIPAA hub · Penalties · Audit logs · CSA

HIPAA Audits: What OCR Checks and How to Prepare

What OCR Commonly Requests

30-Day Prep Sprint