OCR HIPAA Audit Program (45 CFR 160.310)
OCR's authority to conduct compliance audits of covered entities and business associates, and the recurring posture under the Audit Program established by HITECH.
Primary source
45 CFR 160.310 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-C/section-160.310
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 160.310 requires covered entities and business associates to cooperate with the Secretary's compliance reviews, complaint investigations, and audits — and to permit access to facilities, books, records, accounts, and other information.
Section 13411 of HITECH directed HHS to perform periodic audits to ensure covered entities and business associates are in compliance. OCR launched Phase 1 (2011-2012) and Phase 2 (2016-2017) audit programs. Audits were primarily desk audits — entities submitted documentation against specific Privacy, Security, and Breach Rule controls.
Audit findings published by OCR documented widespread deficiencies in risk analysis, risk management, content of the Notice of Privacy Practices, and right of access procedures. OCR has signaled continuation of an audit program; as of the last review date below, the agency's specific next-round timeline is not finalized.
In practical terms, a Phase 3 audit posture is the same as any compliance review: have a current risk analysis, current Notice of Privacy Practices, current policies and procedures, documented training, documented BAAs, and documented breach risk assessments. The Phase 2 audit protocol remains publicly available and is the closest thing to a published audit checklist.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Enforcement Rule Overview (45 CFR 160 Subpart C-E)The framework for HHS investigation and enforcement of HIPAA violations: complaints, compliance reviews, informal resolution, civil money penalties, and the four-tier culpability structure.
- RegulationHIPAA Security Risk Analysis Standard (45 CFR 164.308(a)(1)(ii)(A))Required implementation specification: conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
- RegulationHITECH Enforcement Changes (42 USC 17939)HITECH expanded HIPAA enforcement with state attorney general civil actions, four-tier penalties, willful neglect mandatory investigation, and a percentage of CMPs to harmed individuals.
- SRAWhat to Do If You Get an OCR Audit LetterA step-by-step response framework for a small practice that receives an OCR HIPAA audit or investigation letter, drawn from OCR's audit protocol and published Resolution Agreements.
- SRAOCR Audit Protocol: What Small Practices Should ExpectHow the HHS Office for Civil Rights HIPAA Audit Protocol is structured, what OCR has publicly announced about the audit program restart, and how a small practice prepares its binder against the protocol's audited elements.
- GlossaryCorrective Action Plan (CAP)A documented plan describing steps to address identified compliance deficiencies, the owners, timelines, and monitoring.
- RegulationHIPAA Civil Money Penalty Tiers (45 CFR 160.404)The four-tier culpability and penalty structure for HIPAA civil money penalties, with statutory caps adjusted annually for inflation.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.