The research compliance officer conducted an audit of a research protocol and found that a signed HIPAA authorization was not in the study file for one patient . The patient submitted a letter to the facility indicating that he remembered signing the HIPAA authorization and that the research team must have misplaced the document . The document could not be located . Due to the full SSN being at risk , Veteran A will be sent a letter offering credit protection services . ;