Got an OCR or auditor letter?
Take a breath. Harborline senior practitioners on your side for the first 72 hours and a defensible risk analysis after.
- What to do in the first three days
- Judgment-free review of where you stand
- When you need a full risk analysis: fixed fee, scoped on a short call
Sound familiar?
- The letter asks for your risk analysis and you are not sure the current one qualifies
- Policies exist somewhere but nobody has updated them in a few years
- Training records are spread across email, a shared drive, and someone's memory
- The response window is measured in weeks and nobody owns it internally
How we help
Read the request with you
We go through each item OCR asked for and map it to what you already have, what needs rebuilding, and what has to be created.
Build the risk analysis
A written Security Rule risk analysis with a ranked remediation plan, the document these requests almost always center on.
Assemble the response package
Policies, training records, and evidence organized in the order the request lists them, with a cover summary your counsel can review.
Turnaround is 2 to 4 weeks for a typical single-site, remote risk analysis at a fixed fee, scoped on a short call, with the response package assembled alongside it. If your deadline is tighter, say so on the call.
Start with the assessment. Stay with the annual program.
The risk assessment
A complete picture in 2 to 4 weeks for a typical single-site, remote engagement: breach risk, compliance posture, privacy requirements, and practical impact, with a ranked remediation plan.
The Annual Security Program
The assessment findings become a quarterly calendar of policy updates, training, vendor reviews, and board-ready reporting, so you can prepare for next year's deadline before it arrives.
Common questions
Do we need a lawyer too?
Usually yes, and we work alongside your counsel. We handle the security and documentation substance; they handle the legal position.
Is a letter the same as an investigation?
Not necessarily. A complete, on-time package is what OCR asks for first. Outcomes still depend on facts and counsel strategy.
What if our risk analysis is out of date?
That is the most common situation. We produce a current one and organize it for counsel review alongside the other requested evidence.
OCR or Auditor Letter: First 72 Hours
A calm hour-by-hour checklist for the first three days, written for practice admins. Enter your name and work email, and the checklist opens right away.
Ready to talk?
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.