OCR plans to audit 350 covered entities (including 100 health care providers, 45 health plans, and five health care clearinghouses) and 50 business associates (including 35 IT-related business associates and 15 non-IT related business associates). In spring 2014, OCR will confirm email addresses for a pool of covered entities, with future contact coming through the confirmed email address. OCR learned in Phase 1 that without sufficient address confirmation, a hard copy audit notification could languish for weeks. In summer 2014, OCR will collect relevant information from 550 to 800 covered entities to obtain information necessary for selecting an appropriate sample. OCR will follow up in fall 2014 with notifications and data requests to 350 covered entities.