The evidence set the HHS Office for Civil Rights (OCR) (or a covered entity’s own vendor due-diligence review) expects an organization to be able to produce on demand, dated and retrievable, the day it’s asked for. If you’re also directly regulated as a Covered Entity yourself, check the box below to include your own direct HIPAA obligations too. Answer honestly and confirm your email to get your Readiness Score and full report, free, no account needed.