HIPAA Audits: What OCR Checks and How to Prepare

What OCR Commonly Requests

• Risk analysis and risk management documentation (§164.308(a)(1))
• Policies/procedures and evidence they were in effect (6-year documentation retention)
• Workforce training records
• BAAs and BA inventory
• Access control / authentication evidence and audit-log samples (§164.312)
• Incident and breach investigation files with notification timelines

30-Day Prep Sprint

1. Refresh asset inventory and risk analysis sign-off
2. Export BA register and confirm every active BA has a BAA
3. Pull sample audit logs for EHR, IdP, and admin access
4. Verify breach notification playbooks match 164.400–414 clocks
5. Stage evidence URLs in CSA

How CyberSilo Helps

• CSA packages control-to-evidence matrices for investigator requests
• ThreatHawk produces searchable access timelines for §164.312(b)

Frequently Asked Questions

Does OCR only audit large hospitals?

OCR investigates complaints, breach reports, and compliance reviews across covered entities and business associates of many sizes.

What is the fastest evidence win?

A current signed risk analysis, complete BAA set, and demonstrable audit logging for ePHI systems.

How do breach clocks matter in an audit?

Investigators examine whether notifications met 164.404–410 timelines after discovery.

Related HIPAA Resources

HIPAA hub · Penalties · Audit logs · CSA