"Audited HIPAA entities should expect to receive a data request from OCR requiring a response within two weeks. All information supplied by the audited organization -- which will likely be submitted to OCR through a new web portal -- must be current as of the data request date.... Late submissions or failing to respond to a data request could subject an entity to further investigation and enforcement action. Accordingly, Covered Entities and Business Associates do not have the luxury of waiting to see if they receive a data request before ensuring they are HIPAA compliant."