An envelope from the Office for Civil Rights is not a good day, but it is usually not what practices fear either. Here is what typically happens.
Why it arrived
Most OCR contacts start in one of three ways. A patient complained, often about access to their own records rather than a breach. You reported a breach yourself and this is the follow up. Or a third party reported something.
The largest single category of OCR enforcement actions is not dramatic. It is Right of Access, patients not getting their records. That initiative has now produced 55 enforcement actions, the most recent involving a small optometry practice that paid $50,000 plus two years of monitoring.
What it will ask for
Almost always the same core documents. Your current risk analysis. Your policies and procedures. Evidence of workforce training. Your business associate agreements. And whatever is specific to the complaint.
The risk analysis is the one that decides how the rest goes. If you have a current, dated, thorough one, you are in a conversation. If you do not, you are in a different conversation, because it is the most commonly cited failure in settlements.
The first three things to do
Note the deadline and calendar it. Response windows are real and extensions are usually possible if you ask before the date rather than after.
Do not create documents and backdate them. Whatever the temptation. A missing risk analysis is a compliance failure. A fabricated one is a different category of problem entirely.
Get counsel involved before you reply, particularly if it involves a breach. Practices routinely volunteer more than was asked, which widens the enquiry.
What usually happens
Most OCR matters resolve through technical assistance or a corrective action plan rather than a penalty. The ones that end in settlements tend to share a pattern: no risk analysis, or one that was years old, and a practice that could not evidence basic safeguards.
The uncomfortable but useful point
Most of what OCR asks for is what you should have anyway. If reading this list makes you uneasy, the letter is not the problem. The gap is, and it is much cheaper to close before the envelope arrives.
We do a no charge review of where a practice actually stands. No obligation and no pitch if you are in good shape.