On July 11, 2016, the Department of Health and Human Services – Office for Civil Rights (“OCR”) sent email requests to 167 health plans, health care providers, and health care clearinghouses (“Covered Entities”) for materials related to their compliance with the Privacy, Security, and Breach Notification Rules of the Health Insurance Portability and Accountability Act, as implemented at 45 C.F.R. Parts 160, 162, and 164 (“HIPAA”). These requests are part of Phase 2 of OCR’s…