On March 5, 2026, HHS's Office for Civil Rights announced a settlement with MMG Fusion, a Maryland software company that provides practice management software to dental offices. OCR found that MMG impermissibly exposed the protected health information of roughly 15 million individuals. The settlement came with a corrective action plan requiring OCR monitoring for three years.
Three weeks earlier, on February 19, OCR settled with Top of the World Ranch Treatment Center in Illinois for $103,000. A phishing attack in 2023 had compromised patient records. The enforcement wasn't primarily about the phishing attack — it was about the organization's failure to conduct a required risk analysis before the breach happened.
That pattern is consistent across almost every HIPAA enforcement case. The breach or disclosure triggers the investigation. The settlement comes because the organization can't show it had done the documented compliance work the regulation requires. The actual vulnerability — phishing, misconfigured software, unsecured records — is often secondary to the paperwork failure.
OCR confirmed in early 2026 that it's expanding its risk analysis enforcement initiative to also require documented risk management plans. Organizations that have a risk analysis but no documented remediation plan are now in scope for enforcement action, not just those missing the analysis entirely.
If you're a covered entity or business associate under HIPAA — a healthcare provider, health plan, healthcare clearinghouse, or any vendor that handles protected health information on their behalf — this is what you're up against. The question isn't whether OCR will eventually look at your documentation. It's whether your documentation will hold up when they do.
A HIPAA compliance checker gives you an answer to that question before OCR does.
What HIPAA actually requires in writing
HIPAA has two main rules that generate documentation requirements: the Privacy Rule and the Security Rule. The Privacy Rule covers how PHI can be used and disclosed. The Security Rule covers how electronic PHI (ePHI) must be protected.
Both rules require specific written policies and procedures. Not just having the controls in place — having them documented in a way that demonstrates the organization assessed its risks and made deliberate decisions about how to address them.
Here's what OCR actually asks for when they audit you:
- Risk analysis: A documented assessment of risks and vulnerabilities to ePHI. This is required under 45 CFR §164.308(a)(1). It's the most commonly cited deficiency in enforcement actions.
- Risk management plan: How you're actually addressing the risks the analysis identified. As of 2026, OCR is explicitly auditing this separately from the risk analysis itself.
- Notice of Privacy Practices: The patient-facing document that explains how your organization uses and discloses PHI. Required under 45 CFR §164.520. Must be updated when your practices change — and again, February 2026 brought new requirements for Part 2 (substance use disorder records) that required updates to NPPs.
- Workforce training records: Documentation that employees who handle PHI have received HIPAA training.
- Business Associate Agreements: Written contracts with every vendor that handles PHI on your behalf. Missing or outdated BAAs are a consistent finding in OCR settlements.
- Breach notification procedures: Documented process for identifying, evaluating, and reporting breaches — including the specific timelines (60 days to notify individuals; 60 days to notify HHS for breaches affecting 500+ individuals in a state).
- Access controls and minimum necessary policies: Who is authorized to access what PHI, and documentation showing you've implemented the minimum necessary standard.
- Audit log review policies: Procedures for regularly reviewing audit logs of systems that contain ePHI.
That's a lot of documentation. The practical problem for most organizations — especially smaller healthcare providers and the business associates serving them — is that these policies exist in various states of completeness. Some were written years ago and haven't been reviewed since. Some are templates downloaded from the internet with placeholders still in them. Some cover one regulation but miss requirements from another.
This is exactly what a compliance checker is built to find.
What a HIPAA compliance checker actually does
At its core, a HIPAA compliance checker takes your policy documents and measures them against the regulatory requirements. It's not checking whether your technical controls are correctly configured — that's a vulnerability scanner or a penetration test. It's checking whether your written documentation covers what HIPAA requires it to cover.
Specifically, a good HIPAA checker should flag:
- Missing required elements — Your Notice of Privacy Practices doesn't include the complaint process. Your breach notification policy doesn't specify the 60-day timeline. Your risk management plan doesn't document who owns remediation.
- Vague language that won't satisfy auditors — "We protect PHI using industry-standard safeguards" tells OCR nothing. What safeguards? Who's responsible? When were they last reviewed?
- Outdated references — Policies that reference superseded requirements, old contact information, or systems that no longer exist.
- Gaps between your stated practices and what HIPAA requires — Your access control policy says you'll review user permissions "periodically." HIPAA's Security Rule requires that you actually define what "periodically" means and document those reviews.
The output is a gap list — the specific items in each policy that need attention before an auditor would consider them complete.
Check your HIPAA policies for free
PolicyAudit scans your privacy notices, security policies, and BAAs against HIPAA's Privacy and Security Rule requirements. Find gaps in minutes — not after an OCR letter arrives. Free tier covers up to 3 documents.
Scan your HIPAA policies free →The areas where HIPAA documentation most commonly fails
Risk analysis that describes threats without assessing likelihood and impact
OCR's guidance on risk analysis is specific: you need to identify threats and vulnerabilities, assess the likelihood and impact of each, and document your determinations. Many organizations have a document labeled "risk analysis" that lists threats — ransomware, insider theft, hardware failure — without any assessment of how likely each is or how severely it would affect ePHI confidentiality, integrity, and availability.
A document that lists threats is not a risk analysis under HIPAA. It's a threat list. OCR knows the difference.
WHAT TO FIXFor each threat and vulnerability, document: likelihood (low/medium/high with rationale), potential impact on ePHI, and the resulting risk level. Then document how existing safeguards affect that risk. PolicyAudit checks whether your risk analysis document contains these required elements.
Notice of Privacy Practices missing required content — including 2026 updates
The Notice of Privacy Practices is one of the most publicly visible HIPAA documents, and one of the most commonly incomplete. It must describe all the ways PHI can be used and disclosed, state patients' rights and how to exercise them, explain the complaint process (including HHS's complaint address), and identify a privacy officer or contact point.
The February 2026 deadline for updated Part 2 compliance brought new requirements for organizations that handle substance use disorder records. Any NPP that predates February 16, 2026 should be reviewed for whether it reflects the updated 42 CFR Part 2 requirements if your organization handles SUD treatment records.
WHAT TO FIXCompare your NPP against the required elements in 45 CFR §164.520. If you handle SUD records, check that your NPP addresses the updated confidentiality requirements that took effect February 2026. A compliance checker flags which required elements are present and which are absent.
Business Associate Agreements that are outdated or generic
BAAs are required with every vendor that creates, receives, maintains, or transmits ePHI on your behalf. That includes your EHR vendor, your billing service, your cloud storage provider if they host patient records, and your IT support firm if they have access to systems containing PHI.
The problem isn't usually missing BAAs — it's BAAs that haven't been reviewed since 2013 (when the Omnibus Rule updated requirements), that use generic boilerplate that doesn't reflect the specific services provided, or that don't include required provisions like the business associate's obligation to report security incidents within a reasonable time.
WHAT TO FIXAudit your vendor list against your BAA inventory. For each BAA you have, verify it includes all required elements under 45 CFR §164.504(e): permitted uses and disclosures, safeguard requirements, breach reporting obligations, and termination provisions. A compliance scanner checks whether your BAA template contains all required provisions.
Security policies that describe controls without documented implementation
HIPAA Security Rule compliance requires both the policy and evidence that it's followed. An access control policy that says "we implement role-based access to limit PHI access to authorized individuals" is the starting point — but auditors want to see records of access reviews, documentation of who has what access and why, and evidence that terminated employees' access was revoked promptly.
The policy document is what a compliance checker evaluates. But be aware that passing the documentation check means you still need the operational processes behind it. The policy needs to be specific enough to actually direct those processes — generic policies that describe good intentions without specifying who does what by when are a common gap.
WHAT TO FIXReview each Security Rule policy for: who is responsible for the activity, how often it's performed, what records are kept, and who reviews those records. Policies that use passive voice ("access will be reviewed") without naming responsible parties rarely satisfy auditors.
What the 2026 HIPAA Security Rule update means for your documentation
The proposed HIPAA Security Rule overhaul is expected to finalize in mid-2026 with compliance deadlines following in 2027. The biggest change: the elimination of the "addressable" implementation specification category.
Under the current rule, some security controls are "required" (mandatory for everyone) and some are "addressable" (required unless you document an equivalent alternative). Encryption of ePHI at rest is currently addressable — meaning you can decline to implement it if you document a reasonable equivalent. Multi-factor authentication is addressable. Annual vulnerability scanning is addressable.
The proposed update makes all of these required. If it's finalized as proposed, organizations that have been relying on documented alternatives to encryption or MFA will need to implement those controls — not just document why they haven't.
The 2026 Security Rule update hasn't finalized yet, so current compliance requirements still apply. But if your security policies document alternatives to encryption, MFA, or vulnerability scanning, you should be planning to replace those alternatives with the actual controls. Waiting for the final rule before starting is waiting too long.
For documentation purposes: now is a good time to audit whether your current security policies are built around the "required" controls or around documented alternatives. A compliance checker can tell you which approach your policies reflect and flag the specific gaps that the proposed rule would require you to close.
How to run a HIPAA policy scan with PolicyAudit
PolicyAudit was built to answer one specific question: does this document meet the requirements of this regulation? For HIPAA, that means scanning your uploaded policy documents against the Privacy Rule and Security Rule requirements and flagging gaps.
Here's what to upload first:
- Your Notice of Privacy Practices — This gets checked against §164.520 to verify all required elements are present and current.
- Your Security Risk Analysis — Checked for the structural elements OCR requires: threats, vulnerabilities, likelihood assessment, impact assessment, and current risk levels.
- A Business Associate Agreement template — Checked against §164.504(e) for required provisions.
The free tier covers up to three document scans. For most organizations starting from zero, those three documents cover the areas most likely to come up first in an OCR audit.
The scan output gives you a gap report — specific missing elements, vague language flagged for review, and references to the regulatory sections each gap applies to. That report becomes your remediation checklist.
PolicyAudit isn't a substitute for legal counsel on complex HIPAA questions. If you're navigating the Part 2 SUD records update, handling reproductive health PHI under the new privacy protections, or setting up a formal HIPAA compliance program from scratch, work with a qualified healthcare attorney or compliance consultant. The scanner handles the documentation gap analysis — the judgment calls about novel situations still require human expertise.
After the scan: what to do with the results
A gap report is only useful if you act on it. Here's how to prioritize:
Fix the risk analysis first. Every OCR enforcement trend points here. An incomplete or missing risk analysis is the single most common enforcement finding. If PolicyAudit flags gaps in your risk analysis — missing likelihood assessments, absent risk levels, no documentation of existing safeguards — address those before anything else.
Update the Notice of Privacy Practices second. This is the document patients and regulators are most likely to actually read. Missing required elements here are visible and frequently cited.
Audit your BAA inventory third. This takes time because it requires matching your vendor list against your contracts, but a missing BAA with a major vendor is a serious exposure that's easy to miss when you're not looking at it systematically.
Document your remediation. After fixing each gap, keep a record of what changed and when. If OCR ever does audit you, showing that you identified gaps and corrected them demonstrates a functioning compliance program — which is significantly better than showing either that you found gaps and ignored them, or that you had no idea the gaps existed.
Frequently asked questions
Find your HIPAA policy gaps before OCR does
PolicyAudit checks your privacy notices, security policies, and BAAs against HIPAA requirements. Upload a document and get a gap report in under a minute. Free for up to 3 documents — no credit card required.
Check your HIPAA policies free →