Guide for practice admins

What OCR asks for after a breach

Short answer: After a breach report, OCR usually asks for your most recent risk analysis, your risk management plan, your security policies, training records, business associate agreements and how you handled the incident. Having these ready makes the inquiry easier to answer. OCR has made the risk analysis a focus of its enforcement, so it helps to have yours current and easy to find.

Documents OCR commonly requests

Your current HIPAA Security Rule risk analysis, and earlier ones.
Your risk management plan: what you fixed and when.
Security and privacy policies and procedures.
Workforce training records.
Business associate agreements with the vendors involved.
An incident timeline: when you found it, what you did and who you notified.
Breach notification letters and proof they went out.
Access and audit log reviews for the affected systems.

Notification deadlines to know

Patients: notify them without unreasonable delay, and no later than 60 days after you discover the breach.
HHS: if 500 or more people are affected, notify HHS without unreasonable delay and no later than 60 days after discovery. For smaller breaches, report to HHS within 60 days after the end of the calendar year in which you discovered the breach.
Media: also required when more than 500 residents of one state or area are affected.

If a letter has already arrived

Don't guess and don't send more than OCR asked for. Gather what exists, note what's missing, and get help writing the response. See our OCR letter help and the first 72 hours checklist.

FAQ

Common questions

Does OCR investigate small breaches?

Yes. OCR reviews all breach reports, and complaints can start an inquiry no matter the size.

What if we never did a risk analysis?

Start one now and document the date. A late analysis is better than none, and OCR looks at what you did once you knew.

Who can help

Harborline helps outpatient medical, dental and behavioral health practices with about 5 to 100 staff. We run the HIPAA Security Rule risk analysis, do penetration testing in-house, and work alongside your IT provider until the fixes are verified. Tell us what you're facing and we'll set up a free 30-minute scoping call.