You received a letter from OCR
A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
At a glance
A letter from the HHS Office for Civil Rights (OCR) usually means a complaint investigation or a compliance review, often after a patient complaint or a breach report. HIPAA requires you to cooperate. Respond by the deadline in the letter with the documents OCR asks for — typically your risk analysis, policies, training records and evidence about the incident. Many matters close without a penalty — outcomes range from technical assistance or a no-violation finding to corrective action, resolution agreements and civil money penalties. Ignoring OCR makes a penalty more likely.
| Usually triggered by | A complaint, a breach report, or a compliance review |
|---|---|
| Your duty | Cooperate with the investigation (45 CFR 160.310) |
| Deadline | The date in the letter — ask early if you need more time |
| Commonly requested | Risk analysis, policies and procedures, training records, BAAs, incident evidence |
| Possible outcomes | Closed, technical assistance, resolution agreement with a corrective action plan, or civil money penalty |
| Never | Retaliate against the person who complained |
What to do, in order
- Read the letter for the deadline, the case number and exactly what OCR is asking for. Put the deadline in the calendar.
- Before you send anything with patient information or security details, make sure the letter is real: if the sender is not already known to you, check it through OCR contact details you find yourself on hhs.gov, not the links or phone numbers in the message, and agree how to send the answer securely.
- Do not ignore it. Do not pressure, threaten, confront or retaliate against the person who complained (45 CFR 160.316, 164.530(g)); keep providing care and ordinary communication, and coordinate anything about the complaint with your attorney if you have one.
- Decide whether to involve a healthcare privacy attorney. We recommend it for anything beyond a simple information request.
- Preserve everything related to the issue: records, emails, logs, notes and dates.
- Collect what OCR asked for — commonly your risk analysis, policies and procedures, training records, BAAs and the facts of the incident. Many of these are records HIPAA already requires; OCR may also ask for explanations or lists prepared for the request.
- If something was missing or wrong, fix it now and document the fix — corrective action already taken is part of how OCR resolves cases informally.
- Answer every item in the request by the deadline; if you need more time, ask OCR before it passes.
- Keep a copy of your full response and all correspondence.
OCR enforces HIPAA through complaint investigations and compliance reviews (45 CFR 160.306, 160.308). A breach report you filed can lead to a review even if nobody complained. A letter is not a finding that you broke the rules — it is the start of a fact-finding process, and you are required to cooperate with it (160.310).
If OCR finds a problem, it tries first to resolve the matter informally — through demonstrated compliance, a corrective action plan or another agreement (160.312). That is why fixing gaps quickly and documenting the fix matters. Cases that are not resolved informally can end in a resolution agreement with a payment, or a civil money penalty. The practices that end up with penalties are often the ones that didn’t respond: OCR fined a North Carolina dental practice $50,000 after it ignored a data request and a subpoena.
Many of the documents OCR asks for — policies, risk analysis, training records — are ones HIPAA already requires you to keep for six years, which is why a written risk analysis, policies and training records are worth having before any letter arrives.
What OCR usually asks for — and what proves it
OCR rarely stops at “do you have a policy”. Its audit protocol asks for the policy, the procedure, and evidence that the procedure was actually followed. For a small practice, a typical request maps to records like these:
| OCR asks for | What shows you did it |
|---|---|
| Your risk analysis | A dated analysis covering every system, device and place with patient information |
| Risk management | A plan with owners and dates, and proof each measure was put in place |
| Policies and procedures | Current and earlier versions with approval dates |
| Workforce training | Dated training records for each person |
| Business associate agreements | A signed BAA for each vendor that handles PHI for you |
| The incident or complaint | Your timeline, the assessment, notices sent, and what you fixed |
| Patients’ requests for records | A log with the date each request was received and answered |
| Your Notice of Privacy Practices | The current notice; proof it is posted and on your website, where those apply; written acknowledgments, or a record of your good-faith effort and why one was not obtained |
A complaint about one thing can open up the rest
OCR looks at the specific complaint, but its document request often reaches the policies and records behind it. In October 2026 OCR announced its 56th Right of Access enforcement action, against a small dental practice: a patient complained that she had not received her records despite repeated requests, and OCR found that the practice had no right-of-access policies at all. The complaint about one late answer led OCR to broader gaps in the practice’s Privacy and Breach Notification policies and safeguards — which is why the records in the table above are worth having before any letter arrives.
Tools that help
- HIPAA compliance software →ToolPlatforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
- Online HIPAA training courses →ToolOnline HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
Relevant requirements
- Security risk analysis →§ 164.308(a)(1)(ii)(A)
- HIPAA policies and procedures →§ 164.316
- HIPAA training requirements →§ 164.530(b)
- HIPAA documentation retention →§ 164.316(b)(2)
- Business associate agreements (BAAs) →§ 164.502(e)
- Notifying patients of a breach →§ 164.402
Applies to
- HIPAA for dental practices →
- HIPAA for employer group health plans →
- HIPAA for IT providers and MSPs →
- HIPAA for medical billing and coding companies →
- HIPAA for physical therapists and chiropractors →
- HIPAA for SaaS companies that are business associates →
- HIPAA for small medical practices →
- HIPAA for therapists and psychologists in private practice →
Frequently asked questions
Do I need a lawyer to respond to OCR?
It is not required, but for anything beyond a simple data request we recommend involving a healthcare privacy attorney before you respond — what you send becomes the record OCR decides on.
What happens if I don't respond to OCR?
OCR can issue subpoenas and impose civil money penalties. A North Carolina dental practice that ignored OCR's data request and subpoena received a $50,000 penalty in 2022.
Can a patient complain about something that happened years ago?
Complaints must generally be filed within 180 days of when the person knew or should have known about the problem, but OCR can waive that limit for good cause.