The Office for Civil Rights expanded its HIPAA audit program in 2025, moving from reactive enforcement (investigating after a complaint or breach) to proactive desk audits of organizations that have not previously been audited. Home health agencies — as covered entities transmitting ePHI in standard electronic transactions — are in scope for both types of review.
The distinction between a successful audit outcome and a damaging one is rarely about the sophistication of your security technology. It is almost always about documentation. OCR investigators cannot see your firewall configuration or verify that your EDR is running. They can read your risk analysis, review your training records, and confirm whether your incident response plan exists and is current.
This guide walks through exactly how to prepare — not for the ideal of perfect security, but for the reality of what OCR investigators actually assess.
Understanding the Two Types of OCR Review
Desk audit: A remote review in which OCR requests specific documentation by a defined deadline. You have 10 days to respond with the requested materials. The audit focuses on whether you have the foundational compliance documentation HIPAA requires.
Investigation: Triggered by a complaint from a patient or former employee, or by a breach notification you filed. More extensive than a desk audit. Investigators may request interviews with staff and access to system logs, not just documentation.
In both cases, the documents OCR requests first are the same. Having them ready, current, and accurate is the preparation that matters.
Phase 1: The Documentation Audit (Do This Now)
Before any contact from OCR, conduct your own internal documentation audit. Locate, review, and update each of the following:
HIPAA Risk Analysis
Security Officer Designation
A formal written document naming your HIPAA Security Officer: their title, contact information, the date of designation, and a brief description of the role's responsibilities. This should be signed by executive leadership and — critically — current. It's a small document that's easy to overlook, but it's also one of the fastest things an investigator can check against reality: if the designation names someone who left the organization two years ago, it signals the whole compliance file may be stale.
Common failure: The designated Security Officer on file is a former employee, or the role was never formally documented in writing — only assumed informally.
The single most important document. OCR requests this first in every audit type. A compliant risk analysis:
Identifies all systems, devices, and processes that store, process, or transmit ePHI
Identifies threats and vulnerabilities to each
Assesses the likelihood and potential impact of each risk
Describes existing controls and residual risk levels
Is dated within the past 12 months (or since a significant change to your environment)
Common failure: Agencies have a risk analysis from 2021 that hasn't been updated. If your environment has changed — new EHR, new devices, new staff, new locations — the risk analysis is stale. OCR considers a stale risk analysis as evidence of inadequate risk management.
Written Information Security Program (WISP) or Security Policies
A complete written security program is not one document — it's a set of specific policies, each addressing a distinct requirement. OCR investigators may request any of these individually, so a single generic "security policy" document is rarely sufficient. The full set:
Information Security Policy — the overarching governance document that establishes the program
Access Control Policy — how access to ePHI systems is provisioned, reviewed, and terminated
Password Policy — minimum standards for authentication credentials
Remote Access Policy — requirements for all access to ePHI systems from outside the agency office
Acceptable Use Policy — workforce member obligations for system and device use
Sanction Policy — consequences for security policy violations
Incident Response Plan — procedures for detecting, containing, and reporting security incidents (including the HIPAA 72-hour workforce notification procedure introduced in the 2026 update)
Business Continuity and Disaster Recovery Plan — including clinical downtime procedures
Media Disposal Policy — requirements for secure deletion of data from decommissioned devices
Workstation Use Policy — requirements for workstation placement, configuration, and use
These policies must reflect your actual practices — not aspirational standards you haven't implemented.
Common failure: Policies downloaded from the internet and never customized to the agency's actual environment. OCR investigators ask whether staff know the policies exist and follow them.
Business Associate Agreements
A complete list of every vendor, contractor, or business associate with access to ePHI — and confirmation that a current, signed BAA is on file for each. This includes your EHR vendor, billing company, cloud backup provider, IT support vendor, and cybersecurity provider. For each vendor, also track the breach notification timeline documented in the BAA and the next scheduled review date — both are common follow-up questions when OCR reviews the BAA inventory
Common failure: BAAs signed years ago with vendors who have significantly changed their service terms, or missing BAAs with newer vendors added since the original compliance review.