How do OCR HIPAA audits work for small practices?

OCR audits are typically triggered by a breach report, patient complaint, or random selection. The process begins with a notification letter, followed by document requests, an on-site or desk audit, findings report, and corrective action plan if violations are found. Small practices receive the same scrutiny as large organizations.

What documents does an OCR auditor request?

Auditors typically request your Security Risk Assessment, HIPAA policies and procedures, workforce training records and attestations, Business Associate Agreement inventory, breach notification log, incident response documentation, Notice of Privacy Practices, and access control documentation.

How long does a HIPAA audit take?

A desk audit typically takes 30 to 60 days from notification to findings. An on-site audit may take 1 to 3 days on location, with the full process from notification to resolution spanning 3 to 12 months depending on findings and corrective actions.

Can a small practice prepare for a HIPAA audit without a consultant?

Yes, but it requires significant time and HIPAA knowledge. The key is having complete, current documentation: an up-to-date SRA, adopted policies, training records, BAA inventory, and incident logs. One Guy Consulting's Self-Guided plan at $675 per year provides the tools and structure. The Full-Scope plan at $1,300 per year includes hands-on audit preparation support.

HIPAA Audit Readiness for Small Practices

The Audit Process

How OCR HIPAA Audits Work for Small Practices

Small healthcare practices are subject to the same HIPAA audit standards as large hospital systems. OCR does not exempt organizations based on size. Audits can be triggered by breach reports, patient complaints, or random selection.

The HHS Office for Civil Rights (OCR) enforces HIPAA through complaint investigations, breach reviews, and compliance audits. The audit process follows a consistent sequence regardless of organization size.

1

Trigger Event

A patient complaint, reported breach, or random audit selection initiates the OCR investigation. You receive a formal notification letter.

2

Document Request

OCR sends a detailed list of documents to produce: SRA, policies, training records, BAA inventory, breach logs, and incident documentation.

3

Desk or On-Site Review

OCR reviews your documentation (desk audit) or visits your location (on-site audit) to verify that your policies match your actual practices.

4

Findings Report

OCR issues findings identifying any violations, their severity, and whether they constitute willful neglect, reasonable cause, or unknowing violations.

5

Corrective Action

If violations are found, OCR may require a Corrective Action Plan (CAP), impose civil monetary penalties, or negotiate a resolution agreement.

6

Monitoring Period

After resolution, OCR may monitor your compliance for 1 to 3 years to verify that corrective actions are implemented and sustained.

Audit-Readiness Checklist

Documents OCR Auditors Request from Small Practices

If you can produce every item on this list within 48 hours of an OCR request, your practice is audit-ready. These are the documents OCR auditors routinely request during investigations and compliance reviews. For a version you can work through item by item, use the HIPAA audit readiness checklist.

✓
Current Security Risk Assessment (SRA)Completed within the last 12 months, documenting all identified risks, their likelihood and impact, and your mitigation plans. Learn about our SRA process.
✓
HIPAA Policies and ProceduresWritten policies covering Administrative, Physical, and Technical Safeguards, plus Privacy Rule and Breach Notification Rule requirements. Must be adopted (signed and dated), not just downloaded. Preview our policy templates.
✓
Workforce Training RecordsDocumentation proving every workforce member completed HIPAA training: completion dates, topics covered, signed attestations, and any quiz results. See training requirements.
✓
Business Associate Agreement InventoryList of all vendors with PHI access, executed BAA for each, dates signed, and most recent review dates. Learn about BAA management.
✓
Breach Notification LogRecord of all suspected and confirmed breaches, risk assessments performed, notifications sent, and corrective actions taken. Even if you have had no breaches, document that fact.
✓
Incident Response PlanWritten procedures for detecting, responding to, and recovering from security incidents. Must include roles, responsibilities, notification timelines, and escalation procedures.
✓
Notice of Privacy Practices (NPP)Current NPP posted in the office (if applicable) and provided to patients. Must reflect your actual privacy practices and patient rights.
✓
Access Control DocumentationList of who has access to ePHI systems, their access levels, how access is granted and revoked, and your unique user identification method.
✓
Contingency and Disaster Recovery PlanBackup procedures, disaster recovery plan, and emergency mode operation plan. Must include how you restore PHI access after a disruption.
✓
Sanctions Policy with Enforcement RecordsWritten sanctions for workforce members who violate HIPAA policies, plus documentation of any sanctions applied.

Common Gaps

Where Small Practices Most Often Fall Short

No Security Risk Assessment

The single most common HIPAA violation. Many small practices have never completed an SRA or have not updated it in years. This is the first document OCR requests.

Policies Downloaded but Not Adopted

Having generic policy templates in a folder is not compliance. Policies must be customized to your practice, signed, dated, and distributed to your workforce.

No Training Documentation

Saying "we train our staff" without attestation records means you cannot prove it. OCR requires signed acknowledgments and training logs.

Missing or Incomplete BAAs

Many practices have BAAs with their EHR vendor but miss billing services, cloud storage, IT support, and email providers that also handle PHI.

Documentation gaps are the most common finding in OCR investigations. Practices that maintain complete, current records and can produce them within 48 hours of an OCR request are in the strongest position during an audit. The four gaps listed above appear repeatedly in OCR resolution agreements and corrective action plans.

Enforcement

HIPAA Penalty Tiers for Audit Violations

OCR imposes civil monetary penalties based on the level of culpability. Penalty amounts are adjusted annually for inflation. The four tiers defined under 45 CFR 160.404 are:

Tier 1 - Lack of Knowledge: The covered entity did not know and, by exercising reasonable diligence, would not have known of the violation. Penalty range: $145 to $73,011 per violation.
Tier 2 - Reasonable Cause: The violation was due to reasonable cause and not willful neglect. Penalty range: $1,461 to $73,011 per violation.
Tier 3 - Willful Neglect, Corrected: The violation was due to willful neglect but was corrected within 30 days of discovery. Penalty range: $14,602 to $73,011 per violation.
Tier 4 - Willful Neglect, Not Corrected: The violation was due to willful neglect and was not corrected within 30 days. Penalty: $73,011 per violation. Annual caps apply per violation category.

Post-resolution monitoring: OCR may monitor an organization's compliance for up to three years following a resolution agreement or corrective action plan. During this period, the organization must demonstrate sustained compliance with the terms of the agreement.

Key Terms

Key HIPAA Audit Terms Defined

Office for Civil Rights (OCR): The office within the U.S. Department of Health and Human Services that enforces the HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164).

Complaint investigation: Any person who believes a covered entity or business associate is not complying with HIPAA may file a written complaint with HHS, which may then investigate (45 CFR 160.306). Most small-practice enforcement begins with a complaint or a breach report.

Compliance review: An HHS review of whether a covered entity or business associate is complying with HIPAA. HHS will conduct one when a preliminary review of the facts indicates a possible violation due to willful neglect, and may conduct one in any other circumstance (45 CFR 160.308).

Corrective action plan (CAP): When an investigation or compliance review indicates noncompliance, HHS may resolve the matter by informal means, including a completed corrective action plan or other agreement (45 CFR 160.312(a)(1)). A resolution agreement is the settlement document that typically carries the CAP and any payment.

Civil money penalty (CMP): The fine HHS may impose when a matter is not resolved informally, in tiered amounts based on the level of culpability (45 CFR 160.404). The current tiers are listed in the penalty section above.

Documentation retention: Privacy Rule documentation must be kept for six years from its creation or the date it was last in effect, whichever is later (45 CFR 164.530(j)(2)). Security Rule documentation has the same six-year rule (45 CFR 164.316(b)(2)(i)). Read the enforcement rules at eCFR Part 160, Subpart C.

Frequently Asked Questions

Audit Readiness Questions

Audits are typically triggered by breach reports, patient complaints, or random selection. OCR sends a notification letter, requests documentation, conducts a desk or on-site review, issues findings, and may require corrective action. Small practices receive the same scrutiny as large organizations.

A desk audit typically takes 30 to 60 days from notification to findings. On-site audits may take 1 to 3 days on location. The full process from notification to resolution can span 3 to 12 months depending on findings and corrective actions required.

Yes, but it requires significant time and HIPAA knowledge. The key is having complete, current documentation. One Guy Consulting's Self-Guided plan at $675/year provides the tools and structure. The Full-Scope plan at $1,300/year includes hands-on audit preparation with a Certified HIPAA Professional. See the full pricing breakdown.

HIPAA penalties follow four tiers based on culpability: Tier 1 (lack of knowledge) ranges from $145 to $73,011 per violation; Tier 2 (reasonable cause) from $1,461 to $73,011; Tier 3 (willful neglect, corrected) from $14,602 to $73,011; and Tier 4 (willful neglect, not corrected) is $73,011 per violation with annual caps per category. Most small practice cases result in corrective action plans rather than maximum fines, especially when the practice demonstrates good-faith compliance efforts.

Get Audit-Ready With Confidence

Book a free 30-minute intro call. We will assess your current compliance state and show you exactly what documentation you need to be audit-ready.

Book Your Free 30 Minute HIPAA Compliance Review