Briefing
The HIPAA Security Rule requires an accurate and thorough assessment of risks to the confidentiality, integrity and availability of ePHI. OCR's Risk Analysis Initiative focuses enforcement on organizations that skipped it.
Two 2026 actions show the pattern. In February, Top of the World Ranch Treatment Center paid $103,000 after a phishing incident exposed 1,980 patients' records. In April, four ransomware settlements totaled $1,165,000 and covered more than 427,000 people. OCR found a missing or inadequate risk analysis in each, and each corrective action plan required a risk management plan.
Common shortfalls are a template filled out once, an assumption that the IT vendor handles it, a purchased certificate, and a scope that misses devices and vendors.
What to do
- Data map: where ePHI is created, received, stored and sent.
- Threats and vulnerabilities for each location and flow.
- Current safeguards, recorded honestly.
- Likelihood, impact and risk rating for each item.
- Risk management plan with owners and dates.
- Update schedule and triggers: new systems, locations, vendors or incidents.
How to verify
- The analysis is dated and reflects current systems.
- A technical review of devices, network, email and cloud apps backs the interviews.
- The risk register has owners who still work there.
- Remediation items show completion dates.
Sources
- HHS, Guidance on Risk Analysis
- HHS OCR, Top of the World Ranch Treatment Center settlement, Feb 19, 2026
- HHS OCR, Four HIPAA Security Rule ransomware settlements, Apr 23, 2026
- HHS FAQ, Are we required to certify our organization's compliance with the Security Rule?
Want help putting this in place? Contact Computer Plus.