As we previously reported, on March 21, 2016, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) launched the long-awaited Phase 2 of the audit program that is intended to assess compliance with the Privacy, Security, and Breach Notification Rules adopted under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH). Phase 2 HIPAA audits are expected to involve more than 200 desk and on-site audits of covered entities and business associates, occurring in three rounds: round one will involve desk audits of covered entities, round two will involve desk audits of business associates, and round three will involve more comprehensive on-site audits of both covered entities and business associates.

The first round of audits is now under way—167 covered entities (including health plans, health care providers and health care clearinghouses) were notified by email earlier this week that they had been selected for desk audits and have until July 22, 2016, to submit requested documents through a portal on the OCR website. As expected, these desk audits will focus on compliance with requirements relating to security risk analyses and security risk management, notices of privacy practices, affording patients access to their medical records, and content and timeliness of breach notification. OCR noted that these particular requirements are being targeted in these desk audits because OCR’s pilot audits and enforcement activities have indicated that these are frequent areas for noncompliance.

Even if your company was not selected in this wave of audits, more audits are coming, and even minor breaches can trigger regulatory scrutiny. Covered entities and business associates should check the OCR website regularly for updates relating to the audit process. Further, entities can cross-check their HIPAA policies and procedures against the audit protocols OCR has made available in connection with this audit process. Special attention should be paid to OCR’s articulated areas of interest in privacy, security and breach notification. With only 10 business days to respond to this audit request, whether you need these documents now to respond to an audit letter, or you may need them later to respond to a breach investigation, this is an excellent moment to prepare and shore up compliance.