HHS OCR HIPAA Complaint Investigation Response

The situation

Dr. Maria Chen, 44, runs a 3-physician primary care practice in Sacramento. In March 2026, she received a 9-page OCR HIPAA Desk Review letter. A former patient had filed a complaint alleging Dr. Chen's practice had disclosed the patient's mental health records to the patient's employer without authorization.

The letter gave Dr. Chen 30 days to submit: (1) a copy of all relevant HIPAA policies and procedures; (2) workforce training logs for the past 3 years; (3) her current Security Risk Analysis; (4) any breach log entries for the period; (5) a narrative description of the alleged incident and corrective actions taken.

Dr. Chen has policies, somewhere. She uses an EHR with a built-in NPP. She ran a "risk assessment" two years ago using some template she found online. She has no idea whether any of these things satisfy OCR's requirements or how to present them effectively.

What she doesn't know: OCR resolves the vast majority of investigations through voluntary compliance, if a provider demonstrates good-faith corrective action in their response, OCR issues a Resolution Letter without formal findings or penalties. A well-structured response that acknowledges what happened, documents corrective actions already taken, and presents updated safeguards is the strongest path to closing the investigation without a formal finding.

HIPAA attorney Sarah Goldstein quoted Dr. Chen $8,500 for response drafting. The 30-day deadline leaves 2 weeks before her response is due.

Who receives this

Small healthcare providers receiving OCR HIPAA complaint investigation letters: solo physician practices, small group practices (2–10 physicians), small dental practices, small behavioral health providers (therapists, psychologists, counselors, small group practices), small pharmacies, and small home health agencies. Primary trigger: the OCR 30-day Desk Review response letter. Secondary: the 45-day Technical Assistance and voluntary resolution letter.

Why the agency will not advise you

OCR investigators cannot advise the entity under investigation on how to structure their response, they are on the opposing side of the investigation. HIPAA compliance software (ComplyAssistant, HIPAAtrek, MedTrainer, Abyde) is designed for ongoing proactive compliance, not for responding to an active OCR investigation letter. These tools help you stay compliant before an investigation, they don't generate the investigation response package.

Key facts, with sources

• HHS OCR receives over 30,000 HIPAA complaints per year and formally investigates approximately 5,000–8,000 cases, with small healthcare providers (solo practices, small group practices, small behavioral health providers) accounting for the majority of investigated entities. OCR sends formal Desk Review investigation letters requiring written responses and documentation within 30 days. OCR's enforcement posture shifted significantly in 2024–2025 following the Change Healthcare breach (affecting 190M+ individuals) and the Biden administration HIPAA Security Rule update, OCR enforcement activity increased substantially. Source: HHS OCR HIPAA Enforcement Highlights — HHS.gov · OCR HIPAA Audit Program — HHS.gov · Decoding the HIPAA Investigation Letter — Abyde
• The vast majority of OCR HIPAA investigations resolve through voluntary compliance, when a provider demonstrates good-faith corrective action, OCR issues a Resolution Letter without formal findings or civil money penalties. OCR's published enforcement statistics show that the majority of closed investigations result in voluntary resolution rather than formal resolution agreements. A well-structured response that proactively documents corrective actions taken since the complaint was filed dramatically improves the probability of voluntary resolution. HIPAA compliance attorneys and consultants charge $5,000–$20,000 to structure OCR investigation responses. Source: OCR HIPAA Complaint Process — HHS.gov · OCR HIPAA Complaint Process Requirements and Response Steps — AccountableHQ
• HHS OCR released an updated Security Risk Assessment (SRA) Tool version 3.6 in September 2025, which is designed for proactive compliance, helping providers conduct risk assessments before an investigation. This tool does NOT assist providers in responding to active OCR investigation letters. The HHS OCR Portal Assistant provides sample letters for patient records access requests, not for responding to OCR investigations of the provider. No self-serve OCR complaint investigation response generator has been identified. Source: HHS OCR and ASTP Release Updated Security Risk Assessment Tool — Hunton Privacy Blog · OCR HIPAA Violation Complaint Portal and Portal Assistant — Compliancy Group

When to bring in a professional

Self-serve responses fit routine cases: clear facts, amounts a business can absorb, and a deadline still ahead of you. Bring in a licensed professional when the amount at stake is large relative to their fee, the facts are genuinely disputed, criminal exposure is possible, or the deadline has already passed. A short paid consultation to sanity-check your plan is often worth it even when you handle the filing yourself.

All sources for this guide

1. HHS OCR HIPAA Enforcement Highlights — HHS.gov
2. OCR HIPAA Audit Program — HHS.gov
3. Decoding the HIPAA Investigation Letter — Abyde
4. OCR HIPAA Complaint Process — HHS.gov
5. OCR HIPAA Complaint Process Requirements and Response Steps — AccountableHQ
6. HHS OCR and ASTP Release Updated Security Risk Assessment Tool — Hunton Privacy Blog
7. OCR HIPAA Violation Complaint Portal and Portal Assistant — Compliancy Group