Use Your Free OCR Consulting – Ep 566 

Ever wish you could get expert HIPAA advice straight from the source – without the invoice? This episode digs into a little-known offering: the “free consulting” that the Office for Civil Rights (OCR) actually gives out, if you know where to look. We break down the seven biggest lessons buried in official OCR videos and settlement guidance, covering everything from keeping tabs on your inventory (yes, all your data – even the digital version of an old truck growing weeds) to why risk management means more than doing paperwork once a year. If you’re in healthcare and want practical tips to avoid trouble before it makes the headlines, this episode’s for you.

In this episode:

Use Your Free OCR Consulting – Ep 566

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn more about Kardon Club and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

Episode Roadmap

Use Your Free OCR Consulting

For the last year, everyone has been focused on potential HIPAA Security Rule changes.

We told people not to get ahead of themselves.

We’re now in June and we’re still waiting. (Of course, by us doing this episode it means they will come out any day now.)

Meanwhile, OCR has quietly given the industry several hours of free consulting through educational videos.

And if you pay attention, OCR keeps repeating the same themes over and over.

Today we’re going to review what OCR has been teaching us through their videos on:

• Recognized Security Practices (2022) https://www.youtube.com/watch?v=e2wG7jUiRjE
• Risk Analysis (2024) https://www.youtube.com/watch?v=hxfxhokzKEU
• Ransomware and the Security Rule (2024) https://youtu.be/nBKUlAy1OFA?si=zNt3I0qZktfyHeeH
• Risk Management (2026) https://youtu.be/kDyrj-fJzhw?si=e2lRBETisvJQ7H5D

And what those lessons mean today.

Brief Timeline

2022 Recognized Security Practices

OCR explains:

• what counts as an RSP
• how they evaluate it
• what evidence they expect to see
• how it can help during investigations and audits

2024 Risk Analysis

OCR explains:

• accurate and thorough
• inventories
• scope
• methodologies
• common deficiencies

2024 Ransomware and the Security Rule

OCR explains:

• how attacks actually happen
• what they keep finding during investigations
• how poor risk analysis and poor risk management contribute to breaches

2026 Risk Management

OCR explains:

• finding risks is not enough
• they’re expanding enforcement focus to risk management
• organizations must actually reduce risks to a reasonable and appropriate level

After all of these presentations, what keeps showing up? Let’s review the free consulting tips

Free Consulting Lesson #1

Know What You Have: Inventory, inventory, inventory.

How can you protect everything if you don’t know what you have, who is responsible for it, and where it lives?

OCR keeps talking about it in every one of the videos it comes into play at some point.

• Risk Analysis must have it to do proper Risk Management
• RSPs expect you to have it see HICP and NIST requirements for that.
• Ransomware protections and incident response both require you to know everything you have.

Inventory appears everywhere.

Questions:

• Where is your ePHI?
• What systems touch it?
• What vendors touch it?
• What applications touch it?
• What data flows exist?

Free Consulting Lesson #2

Your Inventory Better Include AI.

One thing we can all see while reviewing these OCR presentations is that AI isn’t a major focus at any point. That’s understandable because some of these presentations were created before the current AI explosion. But if we apply OCR’s own reasoning, AI absolutely belongs in your risk analysis and risk management process.

OCR repeatedly says:

• inventory your systems
• inventory your software
• map your data flows
• identify threats
• identify vulnerabilities
• assess risks
• implement mitigation

If you’re inventorying systems in 2026 and AI isn’t listed, you’re almost certainly missing part of your environment.

Do you have:

• ambient listening tools?
• AI scribes?
• Copilot?
• ChatGPT Enterprise?
• Gemini?
• AI-enhanced EHR functions?
• AI-powered call center tools?
• AI coding assistants?

If yes, where are they:

• on your inventory?
• in your data flow diagrams?
• in your vendor assessments?
• in your risk analysis?
• in your mitigation plans?

Again, you can’t protect what you don’t know you have. One of the biggest risks we see today isn’t that organizations forgot to inventory servers. It’s that they forgot AI is now part of the environment.

Free Consulting Lesson #3

Your Risk Analysis Must Be Real

OCR repeatedly calls out what is not an SRA:

• MIPS assessments
• PCI assessments
• Gap analyses
• Executive summaries
• Heat maps

The common problem: People mistake summaries and compliance exercises for a true risk analysis.

OCR wants:

• comprehensive
• accurate
• all ePHI
• all systems
• all data flows

Free Consulting Lesson #4

Risk Management Means Doing Something

This is the big takeaway from the 2026 video.

OCR keeps describing organizations that:

• identified risks
• documented risks
• reassessed risks
• found the same risks again
• got breached
• fixed them afterward

Risk analysis identifies the hole in the boat. Risk management is fixing it. What OCR keeps finding are organizations with a beautifully documented hole, complete with meeting notes, risk rankings, management reviews, and annual updates. The only thing missing is the installed patch.

One of the most common responses we hear is, ‘We requested funding, but it hasn’t been approved.’ And honestly, that’s a real challenge in a lot of organizations. The problem is that the attackers don’t care whether your request was approved, and OCR is ultimately looking at whether the risk was reduced to a reasonable and appropriate level.

The security officer doesn’t always control the checkbook. But they do control whether the risk is documented, communicated, escalated, monitored, and whether alternative mitigations are considered. The point OCR makes is they keep seeing this sequence of events:

• You identified the risk.
• You requested funding.
• Management denied it.
• Nothing else happened.
• Risk remains unchanged.
• Three years later it’s still on the list.

If you are in that funding situation what they want to see is this sequence of events:

• You identified the risk.
• You requested funding.
• Management denied it.
• You documented everything.
• You looked for compensating controls.
• You implemented interim safeguards.
• You continued monitoring the risk.

If funding was denied, can you show:

• the request
• the risk ranking
• the management decision
• alternative controls considered
• interim safeguards implemented
• ongoing review

Because now you’re back to OCR’s recurring message: Show your work.

No documentation doesn’t fix the problem but it does show something very important is taking place. It proves that the organization understood the risk, communicated the risk, and made deliberate decisions about managing the risk.

A beautifully documented hole is still a hole. But a beautifully documented hole with no attempt to reduce the risk is very different from a documented hole where the organization can show it evaluated options, requested resources, implemented compensating controls, and continued working the problem.

Free Consulting Lesson #5

OCR Wants Evidence

This theme appears in every presentation.

Risk Analysis: Show your work.

Risk Management: Show implementation.

Recognized Security Practices: Show implementation for the previous 12 months.

OCR repeatedly says:

• plans are not implementation
• policies are not implementation
• binders are not implementation

Evidence matters. We don’t miss a chance to mention documentation and the importance of doing it to prove you are following the mitigations including policies, procedures, monitoring, responding to alerts, confirming things are working as intended, and more.

Free Consulting Lesson #6

Ransomware Shows Why All Of This Matters

The ransomware presentation may be the best reality check.

OCR specifically says ransomware investigations often uncover long-standing compliance failures, not random bad luck.

Examples include:

• weak authentication
• lack of MFA
• poor access controls
• poor logging
• poor monitoring
• deficient risk analysis
• deficient risk management
• weak backups

This is where all the earlier lessons become real. The video includes discussions about how following HIPAA requirements helps prevent attacks. It includes a discussion about the findings in their investigations where attacks occurred. Remember if it isn’t documented it didn’t happen. Scout’s honor doesn’t cover you here.

Free Consulting Lesson #7

The SRA Tool Is Helpful But Not Magic

OCR supports the tool.

We support the tool.

But OCR also makes clear:

• It is a tool
• It is questionnaire-based
• Organizations remain responsible for an accurate and thorough assessment
• Organizations must account for risks beyond the questionnaire

The tool wasn’t built around today’s AI landscape. That doesn’t remove the obligation to identify, assess, and manage AI-related risks, though. We can say it is better than doing nothing and should keep you from being deemed willfully neglecting your obligation to comply. But, it won’t help much if you just filled it out and did nothing else with the information.

We did an assessment of a group that had been told for the last few years that their assessments were being done with that tool. But, what they provided to us was a very limited use of the tool, at best.

Closing

Risk analysis identifies the holes. Risk management installs the patches. OCR’s free consulting has spent the last four years explaining both. So before we worry about the next HIPAA Security Rule update, let’s make sure we’ve fixed the holes we already know about so they don’t sink the ship.

The funny thing is that if you follow the free consulting OCR has already given us, you’ll probably be better prepared for the future Security Rule than the organizations spending their time guessing what might be in the next rule or buying solutions to solve problems that OCR hasn’t actually told them they have. Because whether it’s inventory, AI, risk analysis, risk management, evidence, ransomware, or recognized security practices, OCR keeps coming back to the same message:

1. Know what you have.
2. Know your risks.
3. Fix your risks.
4. Keep evidence.

Use the free consulting. That is why they go to the trouble of publishing it.

When it comes to HIPAA and security, most problems start when the basics get overlooked – like tracking your assets, keeping an eye on vendors, or documenting what you’re actually doing. OCR’s “free consulting” might not be flashy, but it delivers the fundamentals that keep healthcare organizations out of trouble. If you want practical ways to work smarter (not just harder) on compliance, the full conversation has more than a few tips you’ll want to steal before the next audit rolls around.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.