OCR Begins Phase 2 of its HIPAA Audit Program

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has begun its second phase of audits (Phase 2 Audits) of compliance with Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy, security and breach notification standards (HIPAA Standards) as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. Unlike the pilot audits conducted during 2011 and 2012 which focused only on covered entities, OCR’s Phase 2 Audits will include audits of covered entities and their business associates.

The Phase 2 Audits are intended to identify best practices and uncover risks and vulnerabilities that OCR has not identified through other enforcement activities. OCR will use the Phase 2 Audit findings to identify technical assistance and best practices that it should develop for covered entities and business associates. In circumstances where an audit reveals a serious compliance concern, OCR may initiate a compliance review of the audited organization that could lead to civil money penalties.

The Phase 2 Audit Program

Selection of Phase 2 Audit Recipients

OCR will randomly select a pool of covered entities through the National Provider Identifier database and America’s Health Insurance Plans’ databases of health plans and health care clearinghouses. It will then issue a mandatory pre-audit screening survey to the pool of covered entities. The survey will address organization size, location, services and contact information. Based on the responses, the agency will select covered entities, to include health care providers, health plans and health care clearinghouses. OCR intends to select a wide range of covered entities and will conduct the audits between now and the end of this year.

OCR will notify and send email document and data requests to the selected covered entities and will ask them to list, identify and provide contact information for their business associates. It will then select the business associates that will participate in the Phase 2 Audits from this pool of information.

Audit Process

OCR will audit the selected covered entities and selected business associates for compliance with the Security Standards, compliance with the Privacy Standards, and compliance with the Breach Notification Standards.

Covered entities and business associates will have ten (10) business days to respond to OCR’s audit request. The document/data requests will specify the content, file names and other documentation requirements, and the auditors may contact the covered entities and business associates for clarifications or additional documentation. OCR will only consider current documentation that is submitted on time. Failure to respond to a request could lead to a referral to the applicable OCR Regional Office for a compliance review.


Unlike the Phase 1 Audits, OCR will conduct the Phase 2 Audits primarily as desk reviews. There will, however, be some on-site audits. OCR will make the Phase 2 Audit protocol available on its website so that entities may use it for internal compliance assessments.

The Phase 2 Audits will target HIPAA Standards that were sources of high numbers of non-compliance in the Phase 1 Audits, including: risk analysis and risk management; content and timeliness of breach notifications; notice of privacy practices; individual access; Privacy Standards’ reasonable safeguards requirement; training to policies and procedures; device and media controls; and transmission security. OCR also projects that Phase 2 Audits in 2016 will focus on the Security Standards’ encryption and decryption requirements, facility access control, breach reports and complaints, and other areas identified by earlier audits. Phase 2 Audits of business associates will focus on risk analysis and risk management and breach reporting to covered entities.

OCR will present the organization with a draft audit report to allow management to comment before it is finalized. The covered entity/business associate will have ten (10) business days to respond in writing. OCR will review management’s response and issue a final report within thirty (30) business days from the covered entity’s/business associate’s reponse and the final report will be shared with them.

What Should You Do to Prepare for the Phase 2 Audits?

Covered entities and business associates should use OCR’s Phase 2 Audits as an opportunity to review their internal HIPAA policies, procedures and practices by:

  • Confirming that the organization has recently completed a comprehensive assessment of potential security risks and vulnerabilities to the organization (the Risk Assessment);
  • Confirming that all action items identified in the Risk Assessment have been completed or are on a reasonable timeline to completion;
  • Ensuring that the organization has a complete inventory of business associates for purposes of the Phase 2 Audit data requests;
  • If the organization has not implemented any of the Security Standards’ addressable implementation standards for any of its information systems, confirm that the organization has documented (i) why any such addressable implementation standard was not reasonable and appropriate and (ii) all alternative security measures that were implemented;


  • Ensuring that the organization has implemented a breach notification policy that accurately reflects the content and deadline requirements for breach notification under the Breach Notification Standards;
  • Ensuring that they have a compliant Notice of Privacy Practices, not only a website privacy notice;
  • Ensuring that the organization has reasonable and appropriate safeguards in place for PHI that exists in any form, including paper, verbal and electronic protected health information;
  • Confirming that workforce members have received training on the HIPAA Standards that are necessary or appropriate for a workforce member to perform his/her job duties;
  • Confirming that the organization maintains an inventory of information system assets, including mobile devices (even in a bring your own device environment);
  • Confirming that all systems and software that transmit electronic PHI employ encryption technology or that the organization has a documented the risk analysis supporting the decision not to employ encryption;
  • Confirming that the organization has adopted a facility security plan for each physical location that stores or otherwise has access to PHI, in addition to a security policy that requires a physical security plan; and
  • Reviewing the organization’s HIPAA security policies to identify any actions that have not been completed as required (e.g., physical security plans, disaster recovery plan, emergency access procedures, etc.)

Take-aways –

The audit program is an important part of OCR’s overall health information privacy, security, and breach notification compliance activities. OCR uses the audit program to assess the HIPAA compliance efforts of a wide range of entities covered by the HIPAA regulations. Every covered entity and business associate is eligible for an audit, including covered individual and organizational providers of healthcare services, health plans of all sizes and functions, healthcare clearinghouses, and a wide range of business associates of these entities.

The Phase 2 Audits present an opportunity for covered entities and business associates alike to internally examine mechanisms for compliance, identify best practices, discover risks and vulnerabilities that may not have come to light through OCR’s ongoing complaint investigations and compliance reviews, and enable health care providers prevent problems before they result in HIPAA breaches.
For more information and assistance, please feel free to contact us.