HIPAA Audits Coming Soon to a Practice Near You! The U.S. Department of Health and Human Services’ Office of Civil Rights (OCR), which is the main enforcer of HIPAA data privacy and security laws, recently released its HIPAA privacy and security audit protocols. The OCR HIPAA Audit program analyzes processes, controls, and policies of selected covered entities pursuant to the HITECH Act audit mandate. There are three main areas of HIPAA security and privacy that are covered: