Although certifications issues by external organizations might not be recognized by the HHS, proof that a Covered Entity or Business Associate has completed a security evaluation, or documentation relating to staff training can be used as a mitigating factor in the event of an investigation, audit, or inspection by the HHS´ Office for Civil Rights. Organizations that can show they have “exercised a reasonable amount of care” during an investigation into a HIPAA violation are likely to be treated more leniently than an organization that has “demonstrated willful neglect” depending on the nature of the violation, the number of patient records impacted by the violation, and the organization´s history of HIPAA compliance.