OCR Audit for Dental Practices: 30-Day Plan

The HHS Office for Civil Rights uses its HIPAA Audit Program to assess how covered entities and business associates comply with the Privacy, Security, and Breach Notification Rules. An audit is different from treating HIPAA as a once-a-year paperwork event. OCR can examine the mechanisms an organization uses to comply, the documentation behind those mechanisms, and the evidence that required safeguards and processes are actually operating.

For a dental practice, preparation is valuable even if the office is never selected for an audit. The same evidence that supports audit readiness also helps leadership answer operational questions: where ePHI exists, who can access it, what happens when a user leaves, how security incidents are escalated, whether backups restore, which vendors handle PHI, and when the risk analysis was last updated. Building that evidence before a notice arrives reduces the chance that staff have to reconstruct years of decisions under pressure.

OCR's current public audit page still describes the 2024-2025 HIPAA Audits as initiated. HHS says those audits will review 50 covered entities and business associates for selected provisions of the HIPAA Security Rule most relevant to hacking and ransomware attacks. OCR says it plans to publish an industry report after those audits are completed. The public page does not say that all dental practices are part of that group.

That focus is consistent with current enforcement activity. On July 29, 2026, OCR announced its 21st ransomware enforcement action and again emphasized accurate and thorough risk analysis. The lesson for dental practices is not to copy a settlement's corrective action plan as if it were a universal checklist; it is to make sure the practice can demonstrate the Security Rule fundamentals that repeatedly appear in OCR guidance and enforcement: risk analysis, risk management, access control, activity review, incident response, workforce preparation, and recovery planning.

No. The 30-day timeline in this article is an internal preparation sprint, not an HHS deadline. OCR's current public page for the 2024-2025 audits does not publish one universal response period that applies to every future audit or compliance review. If a practice receives a notice, leadership should follow the dates, scope, submission method, and instructions in that specific communication.

This distinction matters because old audit materials can be mistaken for current universal rules. OCR's public protocol includes general submission instructions and the 2016-2017 program used its own procedures, but a dental office should not assume a historical response window still governs a new request. The safest operating rule is to keep evidence organized continuously so the practice can respond promptly to the actual notice rather than relying on an unofficial countdown found in an old checklist.

Start with an evidence map rather than a giant folder. For each HIPAA control or process, identify the policy, the person responsible, the system where implementation can be demonstrated, and the record that proves the process occurred. Examples include a current risk analysis, a risk-management plan with assigned actions, user-access review records, workforce training completion, incident logs, backup and restore test records, business associate agreements, device inventories, security configuration records, and documented evaluations after material changes.

The goal is traceability. A written policy that says access is reviewed should point to dated access-review evidence. A contingency plan that says backups are tested should point to restoration records. A security-awareness policy should point to training dates and materials. OCR's public protocol repeatedly asks for both policies and implementation documentation, which is why a binder that has not been connected to real operational records is a weak audit-readiness strategy.

The current Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. HHS's risk-analysis guidance says all ePHI created, received, maintained, or transmitted by the organization is in scope and explains that the rule does not require one specific methodology. For a dental practice, the analysis should therefore reflect the systems the office actually uses rather than a generic template that never inventories the PMS, imaging, cloud services, servers, workstations, remote access, email, mobile devices, or vendor connections.

Risk management should show what happened after risks were identified. Maintain decisions, priorities, owners, target dates, mitigation status, accepted risks, and follow-up reviews. The Security Rule summary published by HHS in August 2026 also emphasizes regular review of records that track access and security incidents, periodic evaluation of safeguards, and reevaluation of risks. An auditor should be able to see a living process rather than a one-time assessment with no evidence of action.

The Security Rule requires technical access controls that allow only authorized people to access systems containing ePHI, and it requires audit controls that record and examine activity in those systems. A useful evidence pack can include role and access matrices, account-approval records, onboarding and termination tickets, privileged-account inventories, MFA enrollment where used, periodic access reviews, remote-access approvals, and records showing how suspicious login or audit activity is reviewed.

Do not invent logs that a dental application does not produce. Instead, document what each system can record, who reviews available logs, what supporting network or identity logs exist, and what compensating procedures are used when a legacy clinical system has limited auditing. If the practice changes a firewall, identity platform, remote-support product, or practice-management system, keep enough change documentation to explain when the control changed and how the new configuration was validated.

A dental practice should be able to connect workforce members to the privacy and security training that applies to their roles. Keep training dates, topics, completion records, policy acknowledgements when used, onboarding evidence, and documentation of training after material policy or role changes. Security-awareness records can also include phishing education, password and MFA guidance, incident-reporting instructions, malicious-software awareness, and periodic security reminders.

Training evidence should match the environment. If the policy says staff must report suspicious MFA prompts or vendor remote-access requests, the curriculum should teach that behavior and the escalation path should identify who receives the report. If a multi-location group has different local downtime procedures, document the site-specific instructions. The stronger evidence tells a consistent story from policy to training to operational behavior.

The current Security Rule requires contingency procedures for emergencies or other events that damage systems containing ePHI, including data backup, restoration, and emergency-mode operations. For audit readiness, collect the written plan together with evidence that the technical recovery process is real: backup job history, protected recovery locations, restore-test records, recovery responsibilities, critical-system priorities, vendor contacts, and records of corrective actions from failed or slow tests.

Incident evidence should show how suspected or known security incidents are identified, reported, documented, contained, and reviewed. Keep an incident register appropriate to the practice, including outcomes and lessons learned. This does not mean every help-desk ticket is a HIPAA security incident; it means the practice has a defined process and can show how events that meet its incident criteria are handled. A tabletop exercise can expose missing contacts, credentials, authority, or recovery dependencies before a real event does.

Maintain a current vendor register that identifies which relationships involve PHI or ePHI, whether a business associate agreement is required, where the executed agreement is stored, and who owns the relationship. Pair the contract record with practical vendor evidence when relevant: approved access, support contacts, security or incident-notification procedures, termination steps, and documentation of material changes. A BAA file should not be the only record showing how a high-risk vendor is governed.

If the practice has experienced an impermissible use or disclosure or a reportable breach, preserve the analysis and notification records required by the Breach Notification Rule. HHS states that covered entities have the burden of demonstrating that required notifications were made or that notification was not required. For breaches that require individual notice, the rule generally requires notice without unreasonable delay and no later than 60 days after discovery. Keep the dates and evidence necessary to show how the practice reached and executed its decision.

Use the request as the scope. OCR's public Audit Protocol instructs entities to provide the specified documents rather than broad compendiums unless requested, and it describes reviewing versions that were in use during the relevant period. Assign one response owner, preserve the original request, map each item to a source record, record who validated the response, and keep a copy of exactly what was submitted.

Do not rewrite history after the notice arrives. If a requested record does not exist, creating a new document and presenting it as an older control can create a more serious problem. Instead, involve appropriate compliance or legal counsel, describe the current state accurately, preserve evidence of remediation, and follow OCR's instructions. Technical staff and an MSP can help export logs, configurations, backup records, and access evidence, but they should not make legal conclusions on behalf of the covered entity.

A South Florida dental practice should make sure the evidence map includes the systems and continuity decisions that become important during facility, power, carrier, or storm disruptions. Document where critical systems and backups are hosted, how staff securely work from an alternate location when authorized, how remote support is controlled, who can change network configurations, and how the practice protects ePHI if a location is unavailable.

Multi-location practices should separate common controls from site-specific exceptions. Central identity, endpoint security, backup standards, incident reporting, and training may be shared, while internet providers, network equipment, imaging systems, building access, and local vendor dependencies can differ. An audit-ready group can explain those differences and show who is accountable for each control instead of assuming that one policy proves every office is configured the same way.

Days 1-7: create the evidence map. Inventory ePHI systems, locations, business associates, security and privacy owners, current policies, the latest risk analysis, open risk-management items, workforce records, incident records, and contingency documentation. Identify missing evidence and separate a missing document from a control that is genuinely not implemented.

Days 8-14: validate technical safeguards. Review active and privileged accounts, terminated-user handling, remote access, available audit logs, security monitoring, backup status, restore evidence, encryption decisions, device inventory, and material configuration changes. Record gaps with owners and dates rather than quietly changing settings without change history.

Days 15-21: validate people and vendors. Reconcile workforce training, policy acknowledgements, security reminders, business associate agreements, vendor access, incident contacts, breach records, and role assignments. Confirm that written instructions match what staff and vendors actually do.

Days 22-30: test the story. Run a document-request tabletop using selected items from OCR's public protocol, time how long it takes to find evidence, test a representative restore or contingency procedure, review the response package for consistency, and document remediation. The goal is not to predict every OCR question; it is to make the practice capable of producing accurate, current, scoped evidence without a scramble.