What steps should IT providers take to prepare for OCR audits