Resources
What OCR actually asks for.
When OCR opens a HIPAA investigation, it asks for the organization's documentation first: written policies and procedures, workforce training records naming who was trained, on what, and when, risk assessments, and incident and breach logs. Training records specifically must show names, dates, topics covered, and delivery method — and be retained six years from creation or last effective date. Organizations that keep this evidence continuously produce a stronger response than organizations assembling it after the letter arrives.
What policies does OCR look for?
Written HIPAA policies and procedures covering privacy, security, and breach notification — not a template that's never been updated to match how the organization actually operates today.
What must training records show?
At minimum: name, date, topic covered, and delivery method. Retained six years from the date of creation or last effective date, whichever is later (45 CFR §164.530(j)(2)).
What does a risk assessment cover?
A documented assessment of where protected health information lives, how it moves, and where it's exposed — reviewed, not written once and filed away.
What does incident and breach documentation cover?
A record of what happened, when it was discovered, who was notified, and what changed afterward. The absence of any incidents on record isn't itself evidence of anything; the absence of a process for logging them is.
How LaborGenie keeps this ready
Every attestation already carries the name, date, topic and delivery method OCR asks for, chained so the record can’t be quietly edited after the fact. Export the evidence pack when the request comes, instead of reconstructing years of history from memory. See how the record works on Platform.
Get the full checklist.
The version above covers the categories. The downloadable checklist breaks each one into the specific items to gather before you're asked — not after.