HHS OCR audit package

The HHS Office for Civil Rights audit package (Reports, for organization administrators, once a HIPAA assessment is offered) gathers what an HHS Office for Civil Rights (OCR) investigator commonly asks for in a HIPAA compliance review or audit: the security risk analysis, the open findings from your HIPAA assessments, policies and procedures, workforce training and sanctions, access reviews, business associate agreements, devices and media, security incidents and breach notifications, individuals' requests and the accounting of disclosures, and the contingency plan.

Each item says what is recorded in Backsplice and links to the record. An item Backsplice does not hold, such as your notice of privacy practices or the configuration of your systems' technical safeguards, says so, so you can add it from your own records.

What it is not

The package is not an attestation. It does not state that any requirement is met, it gives no score, and it has no signature line. An OCR data request names the items and the period it wants: answer that request, not this list, and consider having counsel review your response before you send it to HHS.

Open findings are the gaps recorded in your own HIPAA assessments against the Security and Privacy Rule questions; findings against other frameworks your assessments selected, such as voluntary guidance, stay on the findings register.

Downloading it

The page shows every section; Download PDF and Markdown give the same document as a file. Each list shows its first rows and says how many there are in all, so export the full list from the record when a request asks for it. If a section cannot be read when the package is built, it says so and the package is marked incomplete: generate it again before you send it.