Meta description: Learn when the HHS Office for Civil Rights can audit or investigate a HIPAA violation, what may trigger review, and how organizations can prepare.
The U.S. Department of Health and Human Services Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security, and Breach Notification Rules. It can examine a covered entity or business associate after receiving a complaint, learning about a breach, identifying possible noncompliance, or selecting the organization for an audit. There is no single warning sign or fixed schedule that predicts an OCR review. Knowing what can prompt agency attention—and what to do when a notice arrives—can help organizations respond promptly and reduce compliance risks.
What an OCR HIPAA Review Can Involve
“OCR audit” is often used as a broad term, but OCR activity can take different forms. A complaint investigation examines allegations about a particular organization. A breach inquiry may focus on a reported incident involving unsecured protected health information (PHI). A compliance review can address possible violations OCR learns about through other channels. A formal audit is a separate assessment of compliance, generally based on selected criteria and documentation.
These processes are not interchangeable. An investigation may request records, interview staff, and examine policies or technical safeguards. An audit may use structured questions and document requests to assess compliance. Either can identify issues that lead OCR to seek corrective action. A review does not automatically mean OCR has found a violation.
HIPAA’s enforcement regulations authorize HHS to investigate complaints and conduct compliance reviews. The Health Information Technology for Economic and Clinical Health (HITECH) Act also calls for periodic audits of covered entities and business associates. OCR determines how to use its resources and which matters to pursue; an organization should not assume that every complaint or breach will result in an on-site visit.
Common Events That Can Prompt OCR Attention
A Complaint From a Patient, Employee, or Other Person
OCR may investigate a written complaint alleging a violation of the HIPAA Rules by a covered entity or business associate. Complaints can come from patients, health plan members, employees, or others who believe their PHI was improperly used or disclosed, or that a HIPAA right was not honored. Examples include denial of access to medical records, disclosure to an unauthorized person, or inadequate protection of electronic PHI.
Generally, a complaint must be filed within 180 days of when the complainant knew or should have known about the alleged violation. OCR may extend that period for good cause. A complaint should identify the organization, describe the conduct, and provide relevant dates or supporting information. OCR’s receipt of a complaint does not establish that a violation occurred; the agency reviews the allegations and decides whether to take further action.
A Reportable Breach of Unsecured PHI
A breach report can bring an organization to OCR’s attention. Under the Breach Notification Rule, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. Reports to HHS are also required. For a breach affecting 500 or more individuals, the covered entity must report to HHS without unreasonable delay and within 60 days of discovery. For a breach affecting fewer than 500 people, the entity may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered.
When a breach affects more than 500 residents of a state or jurisdiction, notice to prominent media outlets serving that area is also generally required. A business associate must notify the covered entity of a breach under the applicable rule and the parties’ agreement. It must do so without unreasonable delay and no later than 60 days after discovery; the agreement may require faster notice.
Not every security incident is a reportable breach. The rule defines a breach as an impermissible use or disclosure of PHI that compromises its security or privacy, subject to specific exceptions and a risk assessment. Encryption meeting HHS guidance can render PHI unusable, unreadable, or indecipherable to unauthorized people, which can affect breach-notification obligations. Organizations should document their assessment rather than assume that an incident is exempt.
Information From the Media, Other Agencies, or Public Sources
OCR does not rely only on formal complaints and breach reports. The agency may learn of possible noncompliance through media coverage, referrals, other government agencies, or information shared during another matter. A public account of exposed records, for example, could lead OCR to ask questions even if the organization has not received a patient complaint.
Selection for a Compliance Audit
OCR may conduct audits to assess compliance with HIPAA requirements. Audit selection and scope can depend on agency priorities, available resources, and information gathered by OCR. Selection should not be treated as proof of wrongdoing. An audit may identify compliant practices, gaps requiring attention, or matters that warrant additional investigation.
How Long After a Violation Can OCR Act?
HIPAA enforcement rules generally prohibit HHS from imposing a civil money penalty if the violation occurred more than six years before the penalty is imposed. This is a limit on imposing a penalty, not a guarantee that an organization will receive no inquiries after six years. The rules also address when violations are considered to have occurred, including continuing violations. Records and facts can matter when determining how those provisions apply.
The six-year enforcement period is separate from the general 180-day complaint filing window. A complainant usually must file within 180 days of learning about the alleged violation, unless OCR grants an extension for good cause. A complaint filed on time may concern conduct that began earlier, and OCR’s authority to investigate is not the same as its authority to impose a penalty in every case.
There is no standard number of days between a breach report, complaint, or audit notice and an OCR response. Some reports may not lead to an extensive inquiry; others may prompt follow-up requests. The organization should meet its notification deadlines and preserve relevant records rather than wait for OCR to make contact.
What OCR May Request During a Review
OCR’s requests depend on the issue under review. The agency may ask for written responses, policies, procedures, risk analyses, training records, business associate agreements, incident logs, access records, or evidence of corrective steps. It may also interview employees or request additional information as it evaluates the organization’s compliance.
For a breach, OCR may examine how the incident happened, what PHI was involved, how many people were affected, when the organization discovered the event, and how it responded. It may review whether required notices were timely and complete, whether the organization conducted a risk assessment, and whether its security measures were appropriate to the circumstances.
Organizations should take agency requests seriously and follow the stated deadlines. Responses should be accurate, complete, and consistent with the records. If a request is unclear, the organization can seek clarification promptly. It should not alter, destroy, or backdate documents, and it should retain copies of submissions and communications.
Possible Outcomes of an OCR Investigation or Audit
OCR may close a matter without finding a violation, determine that the evidence does not support the allegations, or conclude that corrective action is needed. In many cases, OCR seeks voluntary compliance and may work with an organization on remediation. Corrective steps can include revising policies, improving workforce training, strengthening access controls, conducting a risk analysis, or monitoring implementation.
More serious or unresolved matters can lead to a resolution agreement and corrective action plan, or civil money penalties. The outcome depends on factors such as the nature and extent of the violation, the harm involved, the organization’s history, and its response. Penalty amounts are subject to statutory rules and inflation adjustments, so a current case-specific determination should not rely on an old penalty chart.
OCR’s findings may also identify broader weaknesses beyond the original complaint or incident. For example, a single misdirected email may lead to questions about workforce training, verification procedures, and incident handling. A breach is not automatically proof of a HIPAA violation, but weak safeguards or an inadequate response can raise additional compliance concerns.
How Organizations Can Prepare Before OCR Contacts Them
Preparation is an ongoing compliance task, not a last-minute exercise. Covered entities and business associates can reduce avoidable risk by maintaining documentation that reflects actual practices and by reviewing it when operations, technology, or vendors change.
- Maintain a current risk analysis. Identify threats and vulnerabilities to electronic PHI, assess potential impact, and document reasonable risk-management actions.
- Review access and security controls. Use appropriate authentication, role-based access, audit controls, and procedures for workforce changes.
- Keep policies and training records. Ensure staff understand privacy practices, security responsibilities, and how to report suspected incidents.
- Manage business associate relationships. Use appropriate written agreements and understand how vendors must report incidents and support investigations.
- Document breach decisions. Record discovery dates, affected information, the risk assessment, notification decisions, and remediation.
- Test incident response. Confirm that responsible personnel know how to contain an event, preserve evidence, evaluate notification duties, and escalate concerns.
These practices do not prevent every incident or guarantee that OCR will not investigate. They can, however, help an organization demonstrate that it has taken compliance seriously and can respond with reliable evidence.
What to Do If OCR Sends a Notice
First, confirm the notice’s authenticity using official HHS contact information, then identify the response deadline and the scope of the request. Assign a responsible lead and involve privacy, security, legal, and operational personnel as appropriate. Preserve relevant emails, logs, policies, contracts, and incident records, including materials that may be stored by a vendor.
Next, map each question to evidence and identify any gaps before responding. Provide a clear, factual explanation; distinguish confirmed facts from matters still under review. If the deadline is difficult to meet, request an extension before it expires and explain the reason. A prompt, organized response is generally more useful than an incomplete submission sent at the last minute.
Organizations should avoid retaliating against anyone for raising a HIPAA concern or cooperating with OCR. They should also avoid making unsupported statements about compliance. Where the matter involves significant exposure, complex legal questions, or potential penalties, qualified privacy or healthcare counsel can help assess obligations and coordinate the response.
Key Takeaway on When OCR Can Audit for HIPAA Violations
OCR can investigate or audit when a complaint, breach report, referral, public information, or agency audit process brings an organization’s HIPAA compliance into focus. There is no fixed schedule for when contact will occur, and selection for review is not itself a finding of wrongdoing. Timely breach reporting, well-maintained compliance records, effective safeguards, and a careful response to agency requests are the most practical ways to manage the risk.