HHS OCR HIPAA Investigation Response Navigator for Small Medical Practices

The situation

Dr. Sarah Chen, 47, runs a solo behavioral health practice in Portland, 280 active therapy clients, one administrative assistant, no compliance officer. In November 2025 she received a formal letter from HHS Office for Civil Rights: OCR has received a complaint that Dr. Chen failed to provide a patient's psychotherapy records within 30 days of the patient's written access request. OCR is opening a formal investigation.

The complaint: a former patient requested their complete treatment record in August 2025. Dr. Chen's assistant prepared the records but accidentally sent the wrong version (missing session notes from the final three visits). The patient filed an OCR complaint in September.

She pulled up OCR's website. It told her OCR will investigate to determine whether she violated the HIPAA Privacy Rule's Right of Access provisions (45 CFR §164.524). She must submit: (1) a factual account of events; (2) her practice's Notice of Privacy Practices; (3) relevant HIPAA Privacy policies; (4) her workforce training records; (5) information about the records request and response.

She called a HIPAA attorney. Quoted $6,500 retainer: "We'll handle the OCR response and prepare you for potential enforcement action."

Dr. Chen thinks this is a simple mistake that has already been corrected, the patient received the complete records the week after filing the complaint. She doesn't believe she should pay $6,500 for a matter she expects OCR will resolve with technical assistance or a simple corrective action letter.

(a) Right of Access cases are OCR's highest-volume enforcement category and most are resolved with a corrective action letter (no civil money penalty) when the covered entity demonstrates the access was ultimately provided and explains the timeline. The key elements in the response: (i) date of patient's written request; (ii) OCR's 30-day deadline and whether it was met; (iii) what records were provided and when; (iv) that the missing records were provided upon discovery of the error; (v) a policy change preventing recurrence.

(b) The response format matters. OCR responses should be on practice letterhead, reference the OCR Case Number from the investigation letter, confirm all facts, and attach: the patient's original access request; the initial records transmittal; the corrected/complete transmittal; the current HIPAA Notice of Privacy Practices; and the access request policy.

(c) A complete, accurate OCR response on a Right of Access case that confirms timely correction typically results in technical assistance, OCR explains the rule, confirms compliance, closes the case. No CMP. The HIPAA attorney's retainer is often unnecessary for straightforward Right of Access correction cases.

Who receives this

Small medical practices, solo practitioners, behavioral health providers, and small dental practices receiving HHS OCR HIPAA investigation notices. Primary segments: (1) solo physicians and behavioral health therapists/psychologists, highest complaint rate relative to patient volume due to direct patient relationships and frequent Right of Access requests; (2) small dental practices with 1–5 dentists, target of OCR Right of Access enforcement wave; (3) small medical practices with EHR transitions, commonly receive Security Rule investigation notices when a breach occurs during EHR migration. Secondary: small business associates (medical billing companies, transcription services) receiving OCR notices after a breach notification.

Why the agency will not advise you

OCR investigators represent the public interest, they cannot advise the subject of their own investigation on how to structure a defense. HHS's SRA Tool and HIPAA compliance platforms provide pre-investigation compliance infrastructure, not investigation response guidance. HIPAA attorneys are the primary alternative at $5,000–$15,000/matter. For straightforward Right of Access or low-severity breach notification compliance matters, the majority of OCR investigations, the response framework is systematic and templateable.

Key facts, with sources

• HHS Office for Civil Rights has received more than 374,000 HIPAA complaints since 2003 and resolves approximately 99% of cases. OCR entered into 13 resolution agreements in 2025 (through available data), 16 in 2024, and 14 in 2023. However, resolution agreements represent only the most severe enforcement outcomes, OCR resolves thousands of complaints annually through technical assistance (voluntary compliance) and informal resolution without formal agreements or penalties. OCR's enforcement focus as of 2025-2026 includes: Right of Access cases (patients not receiving their medical records within 30 days); Security Rule risk analysis failures; and breach notification compliance. Source: Resolution Agreements — HHS OCR · HHS OCR Continues Active HIPAA Enforcement with Three New Settlements — Saul Ewing LLP
• OCR's Risk Analysis Initiative (launched in 2023 focusing on Security Rule risk analysis failures) produced 10+ enforcement actions in the first 18 months, targeting covered entities that failed to conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to ePHI, the foundational HIPAA Security Rule requirement. Small and medium practices are frequently cited: recent resolution agreements include solo behavioral health practices, small radiology groups, and regional physician practices. CMPs in small practice cases have ranged from $35,000 to $200,000+. Source: 2025 Enforcement Trends: Risk Analysis Failures at the Center of HHS's HIPAA Penalties — Ogletree · OCR's New Initiative Yields Seven HIPAA Enforcement Actions in First Six Months — Feldesman LLP
• HIPAA compliance software platforms (Medcurity, Accountable HQ, HIPAA One, Clearwater IRM|Pro, Comp AI) help organizations build and document their HIPAA compliance programs through risk assessments, policy libraries, training tracking, and incident management, these are pre-investigation tools. When OCR opens a formal complaint investigation, these platforms provide the underlying compliance documentation that the respondent needs to attach to its investigation response, but none of them generate the investigation response letter itself or provide guidance on OCR's investigation process. HIPAA attorneys charge $5,000–$15,000 to prepare OCR investigation responses. HHS's own SRA Tool (version 3.6, released 2025) is a Security Risk Assessment guide for building a risk analysis, it is not an investigation response tool. Source: Best HIPAA Risk Assessment Tools for 2025 — Comp AI · HHS OCR and ASTP Release Updated Security Risk Assessment Tool — Hunton Andrews Kurth

When to bring in a professional

Self-serve responses fit routine cases: clear facts, amounts a business can absorb, and a deadline still ahead of you. Bring in a licensed professional when the amount at stake is large relative to their fee, the facts are genuinely disputed, criminal exposure is possible, or the deadline has already passed. A short paid consultation to sanity-check your plan is often worth it even when you handle the filing yourself.

All sources for this guide

1. Resolution Agreements — HHS OCR
2. HHS OCR Continues Active HIPAA Enforcement with Three New Settlements — Saul Ewing LLP
3. 2025 Enforcement Trends: Risk Analysis Failures at the Center of HHS's HIPAA Penalties — Ogletree
4. OCR's New Initiative Yields Seven HIPAA Enforcement Actions in First Six Months — Feldesman LLP
5. Best HIPAA Risk Assessment Tools for 2025 — Comp AI
6. HHS OCR and ASTP Release Updated Security Risk Assessment Tool — Hunton Andrews Kurth