But Serfass, a member of Drinker Biddle's privacy and data security group, said some of the head scratchers could be a sign that OCR believes the breach described is a symptom of an entity's deeper health information protection problems.

"These privacy and data security requirements are meant to be taken very seriously," Serfass said.

The U.S. Department of Health and Human Services (HHS), the parent of OCR, classifies issuers of major medical insurance and long-term care insurance (LTCI) as covered entities for HIPAA purposes. Any vendors or other entities that share protected health information with covered entities are the entities' business associates.

For health and LTCI insurers, the list of business associates includes agents and brokers.

A few years ago, OCR organized a wave of audits that focused more on gathering information and educating covered entities than on imposing penalties. OCR is now organizing a second round of audits, the HIPAA Phase 2 audits. The HHS Office of Inspector General has been pushing OCR to be tougher on entities with violations.

OCR seems to be in the early stages of developing the audit target lists, Serfass said.

"A business associate could certainly be the target of an audit," Serfass said.

Some of the investigations that OCR has already completed may startle laypeople.

In February, OCR announced that it had imposed a $239,800 HIPAA penalty on home care provider. A former employee had violated company rules by taking records home. Her husband filed a complaint about eight years ago, when he found the records in his home after she left him.

Earlier this week, OCR said Raleigh Orthopedic Clinic P.A. of North Carolina has agreed to pay $750,000 to settle a case involving 17,300 X-ray films. In 2013, the clinic sent the films to a vendor that promised to digitize and then destroy the films. The vendor never digitized the films. Instead, the vendor sent the films, which included the patients' full names, to a silver recycling company. The vendor, and the recycler, never gave the clinic any legally valid confirmation that the films had been destroyed. Even though the clinic was the victim of a bad vendor, and tried to comply with HIPAA, OCR went after the clinic because of the clinic's failure to get the vendor to execute a business associate agreement, according to OCR.

To avoid running into situations like that, an entity subject to the HIPAA health information rules needs to make championing privacy and data security part of its culture, Serfass said.

The HIPAA health information protection effort has become a big, growing focus of interest for law firms. At Drinker Biddle, for example, about 5 percent of the lawyers have something to do with health information protection, and Serfass estimates that HIPAA-related issues may take up roughly an average of about a quarter of their time in any given month.

Serfass said OCR has been doing a good job of updating the health information protection community about the Phase 2 audits.

"OCR seems to be committed to communicating very clearly about what's happening," Serfass said.