HIPAA Security Rule for hospitals: what OCR checks

What the HIPAA Security Rule asks of a hospital or health system

When a board, a regulator or a payer asks a hospital leader to prove Security Rule compliance, the honest answer starts with a fact many boards do not expect: HIPAA has no certification. The HHS Office for Civil Rights (OCR) enforces the Security Rule through complaint investigations, compliance reviews and audits, and its 2024 to 2025 HIPAA audits focus on the provisions most relevant to hacking and ransomware. Any vendor or consultant who offers a HIPAA certificate is selling a private opinion, not a federal finding. The organization owns its controls. An implementation partner can prepare systems, configuration baselines and evidence, but only OCR or an independent assessor reaches conclusions about whether those controls work.

The stakes are concrete. For penalties assessed on or after January 28, 2026, the inflation-adjusted civil money penalty ranges from $145 per violation (no knowledge) to $2,190,294 per violation (uncorrected willful neglect), with a calendar-year cap of $2,190,294 (45 CFR 102.3). Hospital leaders should confirm the current figures in the eCFR text of 45 CFR 102.3, since the amounts are adjusted for inflation. Recent resolution agreements show where the exposure sits. Ransomware that led to theft of patient records has been tied to a failed risk analysis, and an insider's inappropriate record access has been tied to missing activity review and audit controls. Ask your security official which of these two patterns your own logs and risk analysis would expose first.

Before the next board meeting, confirm three things: who owns each Security Rule control and signs off on its evidence, which systems hold or move ePHI and are covered by the most recent risk analysis, and whether your audit logs and access reports are reviewed on a schedule someone can name. An outside team can help build the configuration, logging and evidence trail, and an independent assessor can test it. The conclusion that the organization meets the rule stays with the organization and the regulator.

Which Security Rule gaps hospitals most often face

OCR's recent hospital and health system settlements repeat the same few failures: incomplete risk analysis, weak review of who touched records, and unmapped data flows. The cards below cover each gap and the evidence an assessor will ask to see.

Ransomware with data theft

Ransomware is the threat behind many hospital cases, and the Security Rule question is whether the organization had identified where ePHI sat and how an attacker could reach it. In the OSF HealthCare case, the attack led to theft of records for 53,907 patients and OCR cited an inaccurate risk analysis. Check that restore and containment plans reflect what an attacker could actually take.

Insider access to records

Employees who look up records outside their job duties are a recurring finding, and the Montefiore resolution agreement shows OCR treating it as a safeguard failure, not only a personnel matter. Assessors look for role-based access settings, documented access reviews and a record of what staff actually opened. Ask who can see full charts and how quickly terminations remove access.

Activity review and audit controls

Under 45 CFR 164.308(a)(1)(ii)(D), reviewing information system activity is a required implementation specification, not an optional best practice. Assessors expect a defined review schedule, named reviewers and records such as audit logs, access reports and security incident tracking. A log that exists but is never read will not satisfy the review requirement.

Risk analysis accuracy

OCR cites risk analysis failures in most hospital settlements, and the finding is usually that the analysis was incomplete or out of date rather than absent. An assessor will compare the written analysis against the systems in use, including medical devices, cloud services and business associate connections. Confirm that the analysis lists current assets and that the risk register is updated after changes.

ePHI flow mapping

Recent OCR settlements recommend mapping where ePHI enters, moves within and leaves the organization. Without that map, a risk analysis cannot show which interfaces, clinical applications or vendor connections need safeguards. Ask for a current data flow diagram that covers interfaces, backups and third-party transfers, and check that it matches the network and asset inventory.

Encryption where appropriate

Encryption at rest and in transit is an addressable specification, so the organization must decide whether it is reasonable and appropriate and document the reason if it chooses an alternative. Assessors look for that documented decision for each system, including laptops, portable media, backup stores and transmissions to outside parties. A blank or undated decision is the gap to fix first.

How HICP volumes apply to large and small organizations

Hospitals and health systems with many facilities, clinical applications and connected devices use HICP Technical Volume 2, which covers medium and large organizations. Volume 2 takes the ten cybersecurity practices (email protection, endpoint protection, access management, data protection and loss prevention, asset management, network management, vulnerability management, security operations and incident response, network-connected medical devices, and cybersecurity oversight and governance) and describes how a larger enterprise would implement them across its environment.

Start with a risk assessment: Use the Security Rule risk analysis to decide which practices matter most for your organization and in what order.
Map the ten practices to owners: Assign each practice to a named function, such as the security team, clinical engineering or networking, so gaps have an accountable owner.
Plan for medical devices: Network-connected medical devices often sit outside standard endpoint tooling, so the device practice needs its own inventory and segmentation plan.
Tie oversight to governance: Use the governance practice to report on decisions, exceptions and residual risk to executive and board committees.
Document deviations: Where you choose not to adopt a practice or adopt an alternative, record the reasoning and the compensating measure.

Before relying on Volume 2, confirm with your compliance and security leadership which practices your risk analysis supports and which are documented as tailored decisions.

How an OCR audit or investigation moves from notice to resolution

The sequence runs from a complaint or audit selection through document requests and findings to a corrective action plan and either a resolution agreement or a civil money penalty. Each stage produces a record that shapes the next, so the evidence a hospital keeps before notice arrives largely determines how the case ends.

Receive the complaint or audit selection
An investigation starts in one of two ways: a complaint filed with the HHS Office for Civil Rights (OCR), or selection for a compliance review or audit. OCR's 2024 to 2025 HIPAA audits review 50 covered entities and business associates on the Security Rule provisions most relevant to hacking and ransomware, and OCR has said it will publish an industry report once the audits are complete. The organization's counsel and security official should confirm the notice's scope, the named contact and the response deadline stated in the letter. Done when the team has logged the notice and assigned a single point of contact for all correspondence.
Assemble the documentation package
Counsel and the security official gather the records OCR is most likely to ask for: the current risk analysis, the risk management plan, policies and procedures under 45 CFR 164.316, workforce training records, information system activity review logs under 45 CFR 164.308(a)(1)(ii)(D), audit control configuration under 45 CFR 164.312(b), and business associate agreements. Gaps found at this stage should be documented accurately rather than reconstructed after the fact. Done when every requested item is either produced or logged with an explanation of what exists and what does not.
Respond to document and data requests
OCR issues written data requests and may ask for interviews or technical walkthroughs. Responses should be sent through counsel, in the form requested and within the time the notice sets, with a cover index that matches each request to the documents provided. Technical staff should answer only the questions they can support with records. Done when OCR has acknowledged receipt of the full set and the organization holds a complete copy of everything it produced.
Receive OCR's findings
OCR reviews the submitted material and communicates preliminary findings, which may identify failures to conduct an accurate and thorough risk analysis, gaps in information system activity review or audit controls, or impermissible disclosures. The organization has the opportunity to respond to these findings before OCR decides how to proceed. Counsel should confirm the response window in the correspondence. Done when each finding is mapped to the specific standard it cites and the organization has either accepted it or prepared a factual response.
Negotiate a corrective action plan
Where OCR finds violations, the usual outcome is a resolution agreement that includes a corrective action plan. Recent settlements show the typical content: mapping where ePHI enters, flows and leaves systems, periodic risk analysis and risk management, audit controls and regular activity review, encryption in transit and at rest when appropriate, and role-specific training. Monitoring obligations and reporting periods are set in the agreement. Counsel should confirm the duration, reporting schedule and cost of monitoring before signing. Done when the plan is signed and the organization has an owner and a dated task list for each element.
Sign the resolution agreement or face a civil money penalty
A resolution agreement records the settlement amount and the corrective action plan, and HHS publishes these agreements. If no agreement is reached, OCR may impose a civil money penalty under 45 CFR Part 160 Subpart C, and the amount depends on the culpability tier and the inflation-adjusted table in 45 CFR 102.3. The penalty ranges and calendar-year cap in that table should be checked against the current figures before any negotiation. Done when the agreement or penalty notice is final and counsel has recorded the payment and the monitoring obligations.
Complete monitoring and track the public record
After resolution, the organization reports to OCR as the corrective action plan requires and keeps evidence of each control it committed to. Leadership should also track OCR's published audit findings and industry report, since these show which Security Rule provisions are being tested and how. Done when the monitoring obligations are closed in writing by OCR, or when the internal program owner confirms that each remaining report is scheduled and supported by evidence.

What a hospital should have in place before an OCR request arrives

OCR investigations usually start by asking for the same core evidence: a risk analysis, a plan to address its findings, a current map of where ePHI lives, proof that activity is reviewed, written policies and signed business associate terms. The cards below cover each item, who on the compliance team owns it, and where the evidence should sit so it can be produced quickly.

Current accurate risk analysis

The risk analysis is the first document OCR asks for, and enforcement records show it is often the failing point. It must cover all ePHI the organization creates, receives, maintains or transmits, including systems run by vendors. The compliance lead should confirm the date of the last full analysis, that it names specific threats and vulnerabilities, and that it covers the imaging, clinical and billing systems that hospitals commonly miss. Store the signed version with its scope and inputs. Ask whether the analysis reflects systems changed in the past year.

Risk management plan

A risk analysis alone does not satisfy the Security Rule. The risk management plan records each identified risk, the chosen measure, the owner, the due date and the residual risk accepted by leadership. The compliance lead should check that every high-rated finding has a status, that deferred items have a documented reason, and that the plan was reviewed after any security incident. Keep it with the risk analysis so the two can be read together.

Map of ePHI systems and flows

A current inventory shows every system, device, interface and cloud service that holds or moves ePHI, including medical devices, backup targets and third-party connections. The map should show where data enters, moves between systems and leaves the organization. Compliance leads should verify it against the network diagram and the asset register, since gaps between these records are common in ransomware investigations. Assign an owner to each system and review the map when new clinical applications are added.

Reviewed audit logs and access reports

Section 164.308(a)(1)(ii)(D) requires procedures to regularly review records of information system activity, such as audit logs, access reports and security incident tracking reports. Logs that are collected but never read do not meet this requirement. The compliance lead should confirm which logs cover the EHR and other ePHI systems, who reviews them, how often, and what happens when an unusual access pattern appears. Keep signed review records as evidence of each review.

Documented policies under 164.316

Section 164.316 requires written policies and procedures for each Security Rule requirement, plus documentation of required actions, activities and assessments. Retention for these documents is six years under the rule. The compliance lead should confirm that each policy names an owner, shows its effective date and last review, and matches what staff actually do. Policies that describe controls the hospital has not implemented are a common finding.

Business associate agreements under 164.314

Section 164.314 requires business associate contracts or other arrangements that require each business associate to safeguard ePHI. Hospitals often rely on EHR hosts, billing firms, transcription services, imaging vendors and managed IT providers. The compliance lead should keep a register of every business associate, the agreement date, the ePHI involved and the security terms, and confirm that subcontractor flow-downs exist. Missing or outdated agreements are simple to fix before an inquiry but hard to explain during one.

Who owns controls, who prepares evidence, and who assesses

The covered entity or business associate remains legally responsible for Security Rule compliance. Under 45 CFR 164.308(a)(2), the organization must designate a security official who is responsible for the policies and procedures. The hospital decides which addressable implementation specifications are reasonable and appropriate, documents the reasoning, and approves the risk management plan. These decisions cannot be delegated to a vendor in the sense of transferring liability.

Named security official: A person with authority and time to run the program, whether employed or contracted, must be identified in writing.
Risk analysis and risk management decisions: The hospital owns the risk analysis, the risk acceptance decisions and the schedule for reviewing them.
Addressable specification decisions: Each decision to adopt, adapt or replace an addressable specification is recorded with its rationale.
Policy approval and sign-off: Leadership approves the written policies and procedures required by 45 CFR 164.316 and the evidence of who reviewed them.
Workforce and business associate oversight: The hospital is accountable for training, access reviews and business associate agreements.

Before engaging any outside party, confirm in writing which decisions the hospital will keep and which tasks it will hand over.

How to choose an assessor or implementation partner

An independent assessor and an implementation partner do different jobs, and a hospital should keep those roles apart. The cards below cover what to verify for each role and the questions to put to both before signing, because OCR's recent cases turned on risk analysis and activity review gaps that a clear scope and evidence handover would have surfaced early.

Independent assessor experience with hospitals

Ask whether the assessor has tested Security Rule controls at hospitals and health systems, not only small practices or generic IT audits. Ask who on the team will perform the work, how they track ePHI across clinical, billing and imaging systems, and how they would test audit controls and information system activity review against real log sources. HIPAA has no certification, so the assessor's report is an opinion on your controls, and you should request sample deliverables before signing.

Independence from remediation work

An assessor who also designs or installs the fixes is testing its own work, which weakens the finding for your board and for any regulator. Ask the assessor to confirm in writing which remediation services it will not provide to you during the same engagement. Keep the implementation partner separate, and document who signed off on each risk decision so the record shows the organization owned its choices.

Scope written in detail

Hospital scope should list the systems in the risk analysis, including the EHR, PACS, laboratory and pharmacy systems, medical devices, backup repositories, and business associate connections. Confirm which facilities, networks and cloud accounts are in and out. A vague scope such as enterprise security makes the findings hard to reconcile with the actual systems OCR would ask about.

Fixed scope and named deliverables

Ask the implementation partner for a written scope that names each deliverable, its acceptance criteria, the systems it covers and the dates on which work starts and ends. Confirm what is excluded, such as ongoing monitoring or staff training, and how change requests are priced. Most engagements of this kind are fixed scope, so the written scope is the basis for the quote and for judging whether the work was completed.

Evidence handover at close

The partner should hand over the evidence files that show each safeguard works: configuration baselines, access review records, audit log retention settings, backup restore test results and the updated risk management plan. Ask in what format the files will be delivered, who will own the repositories after the engagement, and how the hospital will maintain them. Evidence that only the partner can open does not help during an OCR inquiry.

Experience with your environment

Ask for references from comparable hospital environments, including how the partner handled legacy clinical systems, network-connected medical devices and downtime procedures. Ask how the team would work within change windows and clinical operations. Confirm that the partner can work inside your own infrastructure, whether cloud accounts, data centers or an air-gapped network, and who holds administrative credentials at the end.

What the proposed Security Rule change would mean for hospitals

The current Security Rule is still the only enforceable standard, and hospitals should plan against it. On January 6, 2025, HHS published a proposed major revision of the Security Rule in the Federal Register at 90 FR 898 (RIN 0945-AA22), with comments due March 7, 2025. As of October 2026, no final rule has been published. The Unified Agenda lists the rulemaking under Long-Term Actions with final action projected for July 2027. Those dates can move, so the reader should confirm the current status in the Federal Register proposed rule and the Unified Agenda entry before any planning decision that depends on them.

For a hospital or health system, the practical question is not what the final text will say but whether the current program would hold up under either version. A hospital's risk analysis, audit controls, activity review and access management work already has to meet the existing standards in 45 CFR Part 164 Subpart C. Work that is documented, repeatable and tied to an up-to-date map of where ePHI is created, stored and transmitted is the work most likely to survive a rewrite. Security and compliance leads should ask their legal counsel and privacy officer to watch the rulemaking, and they should ask their platform and clinical engineering teams to confirm which medical device and integration inventories exist today. Hospitals should avoid building new controls around assumptions about a proposal that has not been finalized. Budget and staffing decisions should be tied to gaps in the current rule that OCR has already cited in enforcement, not to proposed language that may change. Where a proposal would add a specific technical expectation, the sensible step is to record the gap as a tracked risk item in the risk management plan, with an owner and a review date.

Hospitals that already run an active change-tracking process can absorb a final rule more easily. The practical checks are a current inventory of systems that hold ePHI, a documented review of the proposal against the controls in place, and a named owner who reports changes to the security official and governance committee. Organizations that want outside help with that review should confirm in writing what a consultant or implementation partner will and will not deliver, because only an independent assessor can state whether a given control meets a requirement.

Questions hospital leaders ask about the Security Rule

Is there a HIPAA certification that proves Security Rule compliance?

No. There is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance, that HHS does not endorse or recognize private certifications, and that a private certification does not prevent HHS from later finding a violation. Any vendor or consultant offering a "HIPAA certified" badge is selling a private attestation, not a government credential. Ask what the document actually tests, who performed the work and whether it covers your full ePHI environment. The HHS FAQ on certification explains the position in HHS's own words.

What does a HIPAA security audit cost a hospital, and what drives the price?

No supplied figure gives a price for a hospital audit, so ask for quotes rather than budgets. Costs fall into two groups. Assessment fees paid to an independent assessor, and internal or contracted effort to prepare systems, policies and evidence. Cost rises with the number of facilities, interfaces to electronic health record and medical device networks, cloud and hosting footprint, business associate count and how much documentation is missing. Ask each bidder to separate one-time work, such as the initial risk analysis and remediation, from recurring work, such as annual reviews, log review and training. Ask who owns each deliverable and what the written scope excludes.

How long does it take to prepare a hospital for a Security Rule review?

The supplied sources do not give a preparation duration, so confirm the timeline with each provider and with your own environment. The length depends on how current your risk analysis is, how many systems hold ePHI, whether audit logs are retained and reviewed, and how many remediation items the analysis produces. OCR's 2024 to 2025 audits focus on hacking and ransomware provisions, so a hospital with a recent, accurate risk analysis and documented activity review starts further ahead. Ask for a written milestone plan with dates and named owners before work begins.

Can our internal security team handle the Security Rule work without outside help?

Many hospitals run most of the work internally, and the Security Rule does not require outside firms. The harder question is capacity and independence. The organization must name a security official and own its policies, risk analysis and decisions. Outside help is most useful for the risk analysis itself, for hardening and evidencing technical controls, and for an independent assessment. Tasks that often go to specialists include audit log pipelines, access reviews across clinical systems and medical device segments. Check whether your team has time for ongoing activity review, not only the initial project. An external assessor can test your work, but it cannot replace your ownership of it.

What do executives need to commit to for Security Rule compliance?

Executives must own the risk decisions, not only approve budgets. The Security Rule places accountability on the covered entity, and OCR enforcement cases show leadership gaps, such as incomplete risk analysis and unreviewed system activity, as recurring findings. Leaders should name the security official, approve the risk management plan, set a review cadence with the board or a committee, and decide which residual risks the organization accepts in writing. They should also confirm that business associate agreements are current and that incident response roles include legal, communications and clinical operations. Ask your team for a one-page summary of open risks at each review.

How are OCR penalties calculated under the HIPAA Security Rule?

Penalties are assessed per violation within a tiered range, and the amount depends on the entity's knowledge and how quickly it corrected the problem. For penalties assessed on or after January 28, 2026, the inflation-adjusted range under 45 CFR 102.3 runs from $145 per violation where the entity did not know of the violation, to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294 for identical violations. OCR also settles many cases through resolution agreements with corrective action plans, such as the Montefiore Medical Center agreement that required a payment of $4,750,000. Each case turns on facts, so review the HHS resolution agreements page and ask counsel how the range applies to your record.

How DeployOpen prepares hospital systems and evidence

DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the hospital's own cloud accounts, data centers or air-gapped networks. Our work supports the Security Rule evidence that the organization owns, while independent auditors and assessors remain the only parties who issue reports or certificates.

How we scope

Written scope names the facilities, systems holding ePHI and platforms in each engagement before work starts.
Scope lists which Security Rule standards the work touches, such as audit controls, access management and contingency planning.
Fixed-scope agreements set deliverables and timelines in writing, and any quote follows directly from that scope.

How we build

We map where ePHI enters, moves through and leaves the platforms in scope, then configure access and logging to match.
Audit logging, access reports and security incident tracking are configured so activity review can be performed and recorded.
Security testing of applications, APIs and infrastructure checks the configured controls before handover.

How we hand over

Documentation covers configurations, procedures and the evidence each safeguard produces, for the hospital's security official to review.
Runbooks describe backup, restoration and incident response steps so staff can operate the platforms without outside help.
The hospital receives the evidence set and should confirm with its own counsel and assessor which items they need for review.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can cover patching, periodic review of audit logs and updates to documentation when systems change.
Ask any partner to confirm in writing which risk analysis and risk management tasks remain the organization's responsibility.