February 17, 2025 Welcome to the second installment of Abyde’s HIPAA Investigation Survival Series. We’ve reviewed the initial breach, which usually sparks an investigation. Still, the actual start of an investigation is when a practice receives an official investigation letter. The investigation letter is usually sent by mail to a practice. However, depending on what information the Office for Civil Rights (OCR) has, this letter could also be sent by email. Knowing how to read and understand a HIPAA investigation letter is vital to the success of your practice. What’s in an Investigation Letter? A HIPAA investigation letter might be overwhelming to receive at first, but it’s important to keep calm. Getting a letter doesn’t necessarily mean you’ll be fined. It is solely a data request from the OCR if you can prove your due diligence in protecting patient data. An investigation letter begins with official letterhead from the Department of Health & Human Services—OCR. It will also provide an OCR Transaction Number, which will be used in all communications regarding this situation. This letter will also include the contact information for the OCR investigator assigned to your case. The letter will begin with the current information presented. For example, if the OCR receives a breach report about a stolen device, it will be mentioned alongside potentially violated HIPAA legislation due to that breach. The first part of the letter sets the scene for what the OCR currently has information about. The second part of the letter is the data request form. In addition to the information previously shared in a breach report (or what was provided by a patient complaint), the OCR requires more information about your current practices regarding securing Protected Health Information (PHI). As stated in the previous installment of this series, sometimes breaches happen, no matter how many precautions your practice takes. Your practice being breached is not the reason for a fine, but your practice’s inability to showcase adequate safeguards in place is. The OCR can and will ask thorough questions. The data request will ask you to provide proof of the compliance standards you have in place. Common questions include proof of an up-to-date and accurate location-specific Security Risk Analysis (SRA), what safeguards you have in place (encryption, antivirus, access logs, etc.), and training completed by staff. These questions all depend on the situation, but overall, they will ask about preventative measures taken, how the situation was handled, and what your practice is currently doing to avoid a similar breach. After the initial questions, the OCR will provide instructions on correctly submitting documentation. The documentation can be sent electronically (and must be encrypted if there’s any PHI) or through mail to the investigator. The letter then concludes with potential enforcement. Potential enforcement includes monetary fines, government monitoring, and, depending on the severity of the violation, criminal time. What’s Next? Upon receiving the letter, it’s time to gather documentation. The timeline documentation that needs to be received is also included in the initial letter. Most often, documentation must be returned to the investigator within 30 days of receiving the letter. Following the initial submission, more documentation might also be requested, so it’s vital to answer the questions thoroughly and provide as much information as possible. Due to how serious a HIPAA investigation is, it’s important to outsource HIPAA compliance for your practice. By having a third party assist in your compliance program, like a smart software solution, you can also be provided a team of compliance experts for support throughout an investigation. By working with a team, their experience is vital to navigate an investigation. To learn more about getting compliant for your practice, schedule a consultation with one of our experts today. To visit our first installment of this series, which is focused on the breach, please visit here. To learn more about organizing documentation for a HIPAA investigation, read the next part of this series. To finish the series, read about the potential outcomes of an investigation here.
