It must provide OCR with documentation describing its best efforts and why it failed to retrieve any drives if that is the case. AHP must provide written certification to OCR that it has met this requirement. Compliance with this corrective action is based on the review and acceptance of the documentation and written certification. Another requirement is that AHP must conduct a security risk analysis that incorporates all electronic equipment and systems controlled, owned, or leased by AHP within 30 days of the effective date. This requirement includes developing a plan to correct vulnerabilities found in the risk analysis and, if necessary, revise current policies and procedures accordingly. AHP must submit these documents to OCR for review and then will have an additional 30 calendar days to respond to OCR comments and recommended changes. When that process is completed, AHP has 30 more days to implement the plan and train employees. The CAP requires AHP to retain the related documentation for six years.