The United States Department of Health and Human Services Office of Civil Rights conducts HIPAA privacy and security audits of covered entities. The Phase I Audits started in 2011.
The OCR has been preparing an online website through which covered entities can submit requested information. The Phase 2 Audits, originally scheduled to begin in the fall of 2014, have been delayed until the online portal is available. The OCR has announced that the Phase 2 Audits may be starting soon.
All employers and covered entities should review their HIPAA compliance tools to make sure they are following appropriate protocol should the group be selected for audit.