However, on September 9, 2014, OCR's health information privacy senior adviser, Linda Sanches, announced the audits would be delayed until 2015 in order for OCR to implement a new web portal to collect and analyze audit data. OCR intends to have both business associates and covered entities audited during Phase 2 of the audit program. Ms. Sanches stated that OCR had initially intended to do 400 desk audits during Phase 2 of the program, but has since decided to shift over half of the intended desk audits into on-site comprehensive audits due to additional funding received and new technology. OCR has also indicated that the 2015 audits will have a strong focus on completion of periodic risk analyses and follow-up risk management actions (as required under the HIPAA Security Rule), content and timeliness of breach notifications (as required under the HIPAA Breach Notification Rule), and notice of privacy practices and patient access rights (as required under the HIPAA Privacy Rule).