The short version
- OCR's Risk Analysis Initiative focuses selected investigations on one requirement: an accurate and thorough risk analysis. The first action was announced on October 31, 2024, and the fourteenth on June 18, 2026.
- Most of the cases began with a breach, usually ransomware or phishing, and ended with OCR finding that the risk analysis was missing, incomplete, or done too late.
- Size does not keep an organization off the list. Settlements range from $10,000 for a Michigan surgical practice to $450,000 for an employer's health plan, and include a small neurology practice, a public hospital, and several business associates.
- The corrective action plans are strikingly similar: a new risk analysis, a risk management plan, updated policies, workforce training, and two or three years of OCR monitoring.
- OCR has said the initiative will grow to cover risk management, meaning whether you acted on what your analysis found. The 2026 CMS attestations ask the same question.
Most HIPAA enforcement news gets read one settlement at a time: a name, a dollar figure, a breach count. That misses the more useful story. Over the past two years OCR has run a deliberate, numbered series of cases about the risk analysis, and the press releases and resolution agreements read almost like a template. If you want to know what OCR expects from your risk analysis, this is the clearest evidence available.
What the initiative is
The risk analysis requirement at 45 CFR 164.308(a)(1)(ii)(A) has been part of the Security Rule since it took effect. What changed in 2024 is how OCR chose to enforce it. On October 31, 2024, OCR announced a $90,000 settlement with Bryan County Ambulance Authority, an Oklahoma ambulance service, and called it the first enforcement action under its new Risk Analysis Initiative.
OCR has described the purpose in nearly the same words in later releases. In its April 2025 settlement with Comprehensive Neurology, it said the initiative was created "to focus select investigations on compliance with the HIPAA Security Rule Risk Analysis provision; to increase the number of completed investigations; and to highlight the need for more attention and better compliance with this Security Rule requirement."
In plain terms, OCR chose to concentrate on the requirement it treats as the foundation for everything else in the Security Rule: you cannot protect ePHI if you have not identified the risks to it. The initiative started under one administration and, as ArentFox Schiff has noted, has continued under the next.
How many actions so far
HHS numbers these cases in its press releases. The most recent numbered action we could verify is the June 18, 2026 settlement with the Spencer Gifts LLC group health plan, which HHS described as the 14th enforcement action in the Risk Analysis Initiative and OCR's 20th ransomware enforcement action.
Settlements announced since then have kept the same focus, even though their releases do not carry an initiative number. On July 29, 2026, OSF Healthcare System paid $552,250 after a ransomware breach, and OCR again found no accurate and thorough risk analysis. On September 17, 2026, Ambry Genetics paid $700,000 after a phishing attack, with OCR citing an inaccurate or incomplete risk analysis among other findings.
A representative sample
The table below covers nine of the numbered actions. Every figure comes from the HHS announcement or a reputable summary of it, linked in the text above and below.
| Organization | Type | Announced | Amount | What OCR found |
|---|---|---|---|---|
| Bryan County Ambulance Authority (1st) | Ambulance service, Oklahoma | Oct 2024 | $90,000 | Ransomware affecting 14,273 patients; no compliant risk analysis |
| Northeast Surgical Group (4th) | Surgical practice, Michigan | Jan 2025 | $10,000 | Ransomware affecting 15,298 patients; no compliant risk analysis |
| Health Fitness Corporation (5th) | Business associate, wellness programs | Mar 2025 | $227,816 | ePHI exposed online from a server misconfiguration; no accurate and thorough risk analysis until January 2024 |
| Northeast Radiology (6th) | Imaging provider, New York and Connecticut | Apr 2025 | $350,000 | Images on a PACS server potentially accessible, 298,532 patients notified; no accurate and thorough risk analysis |
| Guam Memorial Hospital Authority (7th) | Public hospital | Apr 2025 | $25,000 | Ransomware affecting about 5,000 individuals; no accurate and thorough risk analysis |
| Comprehensive Neurology (8th) | Small neurology practice, New York | Apr 2025 | $25,000 | Ransomware encrypted all ePHI, 6,800 individuals; no accurate and thorough risk analysis |
| Top of the World Ranch Treatment Center (11th) | Substance use disorder treatment, Illinois | Feb 2026 | $103,000 | Phishing compromised an email account, 1,980 patients; no accurate and thorough risk analysis |
| MMG Fusion (12th) | Business associate, dental software, Maryland | Mar 2026 | $10,000 | PHI of about 15 million individuals disclosed; no accurate and thorough risk analysis; covered entities not notified |
| Spencer Gifts LLC health plan (14th) | Employer group health plan | Jun 2026 | $450,000 | Ransomware affecting 10,023 individuals; no accurate and thorough risk analysis or adequate policies before the breach |
Sources for the rows: Northeast Surgical Group, Health Fitness, Northeast Radiology, Guam Memorial, Top of the World Ranch, and MMG Fusion, along with the releases already linked.
The patterns that keep repeating
No risk analysis at all. In the first case, OCR determined that Bryan County Ambulance Authority had never conducted one. In an April 2026 group of four ransomware settlements, one imaging provider, Assured Imaging, could not show OCR that a risk analysis had ever been completed.
An analysis that does not cover the whole environment. OCR's standard is "accurate and thorough," and a partial analysis does not meet it. Ambry Genetics was cited for an "inaccurate or incomplete" analysis. Look at where the breaches started: a PACS server, a misconfigured server, a single email account, a software vendor's systems. These are exactly the places a narrow analysis tends to skip. The corrective plans respond directly. Bryan County's resolution agreement requires a new analysis built on a complete inventory of electronic equipment, data systems, off-site data storage, and applications containing ePHI.
An analysis done too late or not kept current. Health Fitness's exposure began around August 2015, but OCR found it did not conduct an accurate and thorough analysis until January 19, 2024. Several corrective plans, including those for Health Fitness and Bryan County, require the analysis to be reviewed and updated every year, and Health Fitness must also set up a process for assessing environmental and operational changes.
No risk management follow-through. Nearly every plan we reviewed pairs the new analysis with a risk management plan to address what it finds. OCR has also said the initiative itself is changing. As HIPAA Journal reported in April 2026, Director Stannard has said it will "evolve to also target noncompliance with the risk management requirement," and an OCR guidance video makes the point that an organization must show it has acted on the findings of its analysis, not just that it performed one.
Ransomware and phishing as the trigger. Five of the nine cases in the table involved ransomware, and a sixth began with phishing. Many of these investigations started with a breach report, and several took years to resolve. Spencer Gifts' plan was hit in November 2021 and settled in June 2026. The analysis OCR evaluates is the one you had before the incident, not the one you commission afterward.
Small organizations are included. A $10,000 surgical practice settlement, a $25,000 neurology practice settlement, and a $25,000 public hospital settlement sit in the same series as six-figure cases. Business associates are there too: a wellness vendor, an accounting firm (BST & Co. CPAs, $175,000, the 10th action), and a dental software company.
What the corrective action plans require
The dollar amounts get the headlines, but the corrective action plans are where the real cost and effort lie. Across the releases and agreements we reviewed, the core terms are consistent:
- A new, accurate and thorough risk analysis covering the confidentiality, integrity, and availability of all ePHI. In Bryan County's agreement, the scope and methodology go to HHS first, and the analysis is revised until HHS approves it.
- A risk management plan with a process and timeline for addressing the risks the analysis identifies.
- Written policies and procedures, developed or revised and, in some cases, submitted to HHS for approval.
- Workforce training on those policies, often annually. Bryan County's agreement bars giving workforce members access to ePHI until they have signed a compliance certification.
- Additional controls tied to the findings. Northeast Radiology and Guam Memorial must regularly review information system activity records. Guam Memorial must also review all access credentials. Ambry Genetics must implement unique user identification.
- Monitoring by OCR, usually for two years and in some cases three. Bryan County's agreement, for example, requires annual compliance reports to HHS, reporting of certain policy violations, and keeping compliance documents for six years.
A useful way to read these plans. Strip out the HHS approval steps and the reporting, and what is left is simply what the Security Rule already requires: an analysis based on a full inventory, a plan to fix what it finds, policies that match, trained staff, and regular review. Organizations under a corrective action plan end up doing that work on OCR's timeline. Everyone else can do it on their own.
What this means for small practices and rural hospitals
Find your current analysis and read it critically. Check the date, and check what it covers. If it does not mention your EHR host, your imaging or lab systems, your email, your backups, and your vendors, it is probably not thorough in the sense OCR means.
Start with the inventory. The corrective plans keep coming back to a complete list of equipment, systems, storage, and applications that hold ePHI. If you cannot produce that list, the analysis built on top of it cannot be complete.
Write the risk management plan down and keep evidence. Name an owner and a target date for each risk, and keep records of what was actually done. OCR's own guidance says policies alone do not show that a security measure was implemented.
Review it every year and whenever something changes. New systems, new vendors, a move, or a security incident should all prompt a fresh look at the affected areas.
Do not assume size protects you. The smallest settlements in this series came from a surgical practice, a neurology practice, and a public hospital. For rural hospitals and critical access hospitals with lean IT staff, the analysis is also the most practical way to decide where limited money and time should go first.
This is the work EHR Resources does for hospitals, clinics, behavioral health providers, and business associates. Whoever does it for you, the corrective action plan language above makes a good checklist for judging whether the result will hold up.
A brief note on the 2026 attestations
CMS has moved in the same direction. The 2026 MIPS Security Risk Analysis measure now asks clinicians to attest both to conducting or reviewing a security risk analysis and to conducting security risk management activities. The 2026 Medicare Promoting Interoperability measure for hospitals and CAHs uses the same two-part definition. An attestation of "yes" is a statement that the work OCR is looking for was actually done.
Thomas J. Johnson, Founder, EHR Resources LLC
Thomas founded EHR Resources in 2011 after three years helping more than 1,400 practices adopt electronic health records under the Meaningful Use program. He served on a national HHS working group that developed guidance for covered entities conducting their own security risk analyses, and has spent the years since conducting them. Read his message to prospective clients or browse more articles.