Why OCR settlements keep citing the HIPAA risk analysis
In the cases supplied for this page, failure to conduct an accurate and thorough risk analysis is the finding OCR cites most often, and resolution amounts ranged from $25,000 to $700,000. If a regulator letter, a ransomware event or a customer questionnaire has brought this question to your desk, start by establishing whether you hold a current risk analysis that covers every system holding electronic protected health information. Ask your team to produce the document, confirm its date and check it against where ePHI actually sits today, including cloud accounts, imaging servers and business associate connections.
The amount and the corrective action depend on the facts of each case. OCR's settlements in this group reflect breach size, whether the entity had any risk analysis at all, and how long notification took. Assured Imaging paid $375,000 after disclosure affecting 244,813 individuals, while Vision Upright MRI paid $25,000 after OCR found it had never conducted a risk analysis and had not notified affected individuals within 60 days. Ambry Genetics paid $700,000 and agreed to a two-year corrective action plan that begins with a new risk analysis and risk management plan. These facts are specific to each agreement, so read the resolution agreement for your own sector before drawing conclusions about your exposure.
Your organization owns its risk analysis, and the decision about what is accurate and thorough sits with your leadership, not with an outside party. An implementation partner or assessor can help prepare the inventory, run the analysis and organize the evidence, but no partner or certification issues a HIPAA certificate, and only OCR, through its own complaint, compliance review or audit process, decides whether a violation occurred. Confirm who signs off on the analysis, how findings are tracked to closure, and how the analysis is updated after major changes. OCR's guidance on risk analysis is the natural starting point for that review.
Recent OCR cases, resolution amounts and findings
This table lists the OCR resolution agreements supplied for this page, with the entity type, the amount paid, the date and the risk analysis finding. Read the amount and finding columns together, because most cases pair a ransomware or disclosure event with a failure to conduct an accurate and thorough risk analysis. Where a figure is not published in the source, the cell says so.
| Entity | Type of entity | Amount paid and date | Risk analysis finding |
|---|---|---|---|
| BST & Co. CPAs | Accounting firm (ransomware case) | Amount not supplied, announced August 18, 2025 | Its 15th ransomware enforcement action and 10th Risk Analysis Initiative action; confirm the finding in the resolution agreement |
| OSF HealthCare System | Health system | $552,250, July 2026 | Failure to conduct an accurate and thorough risk analysis after Nephilim ransomware exposed PHI of 53,907 patients |
| Regional Women's Health Group | Network of women's health providers in five states | $320,000, August 2025 | Failure to conduct an accurate and thorough risk analysis after a cyberattack potentially affecting over 37,000 patients |
| SG Health Plan | Employer health benefits plan | $245,000, January 2026 | Failure to conduct an accurate and thorough risk analysis, plus impermissible disclosure after a 2021 ransomware attack affecting 9,316 individuals |
| Assured Imaging | Imaging provider | $375,000, December 2025 | No compliant risk analysis, plus late breach notification after PYSA ransomware with indications of exfiltration affecting 244,813 individuals |
| Vision Upright MRI | Single-site imaging provider | $25,000, May 2025 | Never conducted a risk analysis; medical images on an internet-accessible PACS server and notice not sent within 60 days |
| Consociate Health | Business associate (health plan administration) | $225,000, December 2025 | Failure to conduct a risk analysis after a phishing compromise led to ransomware reaching a server with PHI of about 136,539 individuals |
| Ambry Genetics | Genetic testing laboratory | $700,000, September 17, 2026 | Failure to conduct an accurate and thorough risk analysis; two-year corrective action plan starts with a new risk analysis and risk management plan |
Patterns that repeat across the settlements
The OCR settlements supplied for this page share a short list of failures, and most of them trace back to the risk analysis. Each card below names one pattern, the cases that show it, and what a covered entity or business associate should check in its own environment.
No risk analysis at all
Some settlements cite no risk analysis at all, not an incomplete one. Vision Upright MRI, a single-site imaging provider, paid $25,000 in May 2025 after OCR found it had never conducted a risk analysis, even though medical images on a PACS server were reachable over the Internet. Ask whether a dated, written analysis exists for every system that stores, transmits or processes ePHI, and who signed it off.
Analyses that skip systems
Several cases cite a risk analysis that was conducted but was not accurate and thorough. OSF HealthCare System paid $552,250 under a July 2026 resolution agreement after Nephilim ransomware led to the theft of PHI of 53,907 patients, and OCR cited the analysis gap. Check that the scope includes servers, medical devices, imaging systems, connected equipment and cloud services, not only the core EHR.
Phishing and ransomware entry points
The attacks in these cases usually began with ordinary access weaknesses. Consociate Health, a business associate, was compromised by phishing six months before a January 2021 ransomware attack reached a server holding PHI of about 136,539 individuals. Review how email accounts, remote access and unpatched systems are identified in the risk analysis and carried into the risk management plan.
Late breach notification
OCR also penalized organizations that knew of risks but did not act on them or report incidents on time. Vision Upright MRI had not notified affected individuals within 60 days, and Assured Imaging received citations for late breach notification after PYSA ransomware encrypted its records system in May 2020. Confirm that your incident response plan links detected risks to breach-notification timelines and named owners.
Business associates held to the same duties
Consociate Health and SG Health Plan show that vendors and plan administrators are not exempt from the analysis requirement. Consociate, a business associate providing health plan administration, paid $225,000 in December 2025 for failing to conduct a risk analysis. Covered entities should confirm that each business associate can produce its own current risk analysis and that the contract requires it.
What the cases mean for practices, hospitals, plans and business associates
Small practices and single-site imaging providers often assume the risk analysis is a formality because they are small. OCR's cases show the opposite. Vision Upright MRI paid $25,000 in May 2025 after medical images on a PACS server were reachable over the Internet, and OCR found the organization had never conducted a risk analysis. Assured Imaging paid $375,000 in December 2025 after PYSA ransomware encrypted its electronic medical records system in May 2020, with indications of exfiltration. OCR cited the disclosure of PHI for 244,813 individuals, the absence of a compliant risk analysis and late breach notification. Both cases turned on basic questions: where the systems were, who could reach them, and whether anyone had written down the threats.
- Internet-facing imaging systems: Ask whether any PACS, modality worklist or image-sharing server is reachable from outside your network, and who approved that exposure.
- Ransomware recovery paths: Confirm that your EHR and imaging backups are offline or immutable and that you have tested a restore.
- Breach clock: Check who decides that an incident is a breach and how the 60-day notification window is tracked from discovery.
- Single-person ownership: Identify who performs the risk analysis and whether that person has written evidence of the work.
- Vendor-hosted systems: Confirm which imaging or EHR components a vendor operates and whether that vendor's risk analysis covers your data.
For a practice of any size, the question to answer first is whether a written risk analysis exists and matches the systems that are running today.
Large systems usually have a risk analysis document, which is why OSF HealthCare System's case is instructive. The July 2026 resolution agreement paid $552,250 after Nephilim ransomware in 2021 led to the theft of PHI for 53,907 patients. OCR cited a failure to conduct an accurate and thorough risk analysis along with the impermissible disclosure. The lesson is that a document can exist and still fail the test if it does not reflect the environment, the threats and the decisions that followed. A system with many facilities, affiliated practices and connected devices has more places where a stale analysis can drift from reality.
- Scope completeness: Compare the analysis against the actual list of hospitals, clinics, affiliated physician groups and connected devices, not just the core EHR.
- Accuracy over volume: Confirm that the analysis names specific threats such as ransomware and phishing, the likelihood and impact of each, and the current controls.
- Risk management linkage: Check that each high risk has a documented treatment plan with an owner and a date, not just an identified score.
- Post-incident updates: Verify that the analysis was revisited after any security incident, acquisition or major system change.
- Disclosure controls: Test whether data sharing outside the system is covered by the same analysis and the same access restrictions.
The question for a hospital CISO is whether the analysis would still be accurate if the most recent incident in your environment had been included.
Health plans and the administrators that run them face two overlapping exposures. SG Health Plan, an employer health benefits plan, paid $245,000 in January 2026 after a 2021 ransomware attack affecting 9,316 individuals. OCR cited the impermissible disclosure and the failure to conduct an accurate and thorough risk analysis. Consociate Health, a business associate providing plan administration, paid $225,000 in December 2025 after a January 2021 ransomware attack. That attack followed a phishing compromise six months earlier and reached a server holding PHI for about 136,539 individuals. The plan sponsor and the administrator each carry obligations, and both need to show their analyses cover the data they handle.
- Plan sponsor data flows: Map which employee benefit data reaches the sponsor and confirm that the analysis covers those flows.
- Administrator dependencies: Confirm which systems the administrator operates and whether the plan has the administrator's analysis or summary.
- Dwell time signals: Check whether phishing alerts, mailbox rule changes and unusual logins are reviewed, since the Consociate attack took months to reach sensitive servers.
- Contract terms: Review business associate agreements for security obligations, notification timing and audit rights.
- Disclosure review: Confirm that any routine plan reporting is limited to what the minimum necessary standard allows.
A plan should be able to show which party performed the risk analysis for each system and where that evidence is kept.
Business associates are directly subject to the Security Rule, and enforcement does not stop at the covered entity. Consociate Health's settlement shows a business associate paying for its own risk analysis failure. Ambry Genetics' settlement, announced September 17, 2026, cited a failure to conduct an accurate and thorough risk analysis after a phishing attack. Ambry paid $700,000 and agreed to a two-year corrective action plan that begins with a new risk analysis and a risk management plan. Vendors that process PHI for several covered entities should treat each analysis as a product of their own work, not a copy of the customer's paperwork.
- Own analysis, own obligations: Confirm that your organization has its own analysis covering the systems that hold PHI for customers.
- Phishing resistance: Verify multi-factor authentication for email and remote access, and test staff reporting of suspicious messages.
- Corrective action readiness: Ask whether your analysis and risk management plan could be produced within a short window if OCR requested them.
- Subcontractor chain: Identify which subcontractors touch PHI and whether each has a written agreement and a current analysis.
- Customer reporting: Confirm the timing and content of breach notices to covered entities under your contracts.
Before signing another customer agreement, a vendor should be able to point to its own dated risk analysis and the risk management decisions it produced.
What a corrective action plan requires after a settlement
A resolution agreement with OCR usually moves an organization through a fixed sequence: a new risk analysis, a risk management plan, workforce and policy updates, and monitoring by OCR for the plan period. Each phase produces written evidence that OCR reviews before it accepts that the corrective action plan is being followed. Confirm the exact terms, deadlines and reporting schedule in each agreement, since they vary by case.
Review the resolution agreement and plan terms
Leadership, the privacy and security officials and counsel read the resolution agreement and the corrective action plan line by line before any work starts. The team maps each obligation to an owner, a due date and the document that will prove it was met. The output is a tracking register agreed with leadership, and the check is that every obligation in the agreement has a named owner and a closure artifact. Confirm the reporting schedule and the monitoring period in the agreement itself, since the Ambry plan ran two years but other agreements differ.
Perform a new accurate and thorough risk analysis
The organization, usually with an outside assessor or implementation partner supporting the work, inventories every system that creates, receives, maintains or transmits electronic protected health information, then identifies threats, vulnerabilities and the likelihood and impact of each. Many settlements, including Ambry's, start the plan with this step because earlier analyses were judged incomplete. The output is a written risk analysis with an asset inventory and data-flow map, and it is complete when leadership has reviewed and signed it.
Adopt a risk management plan with dated measures
The team turns each risk rated as unacceptable into a measure with an owner, a target date and a funded budget line, and records the reasoning for accepting any residual risk. Measures typically cover access control, multi-factor authentication, patching, logging, backup and network segmentation. The output is a risk management plan approved by the accountable executive, and the check is that each high-rated finding traces to a measure and a status.
Update workforce training and written policies
The organization revises its Security Rule policies and procedures to match the new analysis and risk plan, then trains the workforce, including staff who handle ePHI in imaging, billing, clinical and IT roles. Training records show who attended, when and which version of the policy was covered. The output is an approved policy set, a training roster and acknowledgments, and the check is that policy owners can show which revision each employee signed.
Strengthen technical safeguards and incident handling
Engineering teams implement the measures from the risk management plan on the systems in scope, such as encryption, audit logging, patch management, vendor access controls and tested backups. Incident response and breach notification procedures are rewritten and exercised so they meet the notification timing the agreement requires. The output is configuration evidence, change records and an exercise report, and the check is that each safeguard can be demonstrated on a live system rather than only described.
Submit compliance reports to OCR on schedule
The organization assembles periodic reports for OCR that describe completed actions, open items and supporting evidence, and it designates a contact who answers OCR questions. Internal review by counsel and the security official comes before each submission. The output is a dated report with an evidence index, and the check is that every claim in the report links to an artifact that can be produced on request.
Operate under OCR monitoring for the plan period
For the duration stated in the agreement, OCR may request additional documents, review progress and assess whether obligations are being met. The organization keeps the risk analysis current when systems or threats change, logs remediation progress and preserves the evidence trail. The output is a monitored compliance record, and the check is that the organization can show continuous operation of the controls, not a one-time fix, before OCR closes the plan.
Close out the plan and retain the evidence
Once OCR confirms the final obligations are met under the agreement, the organization archives the evidence set, assigns owners for ongoing reviews and schedules the next risk analysis update. The output is a closeout memo and an evidence archive, and the check is that the ongoing program, not the settlement, drives the next cycle. Documentation duties under the Security Rule continue after the plan ends, so retain records accordingly.
How to check your risk analysis before an OCR inquiry
OCR settlements repeatedly turn on the same gap: a risk analysis that was missing, outdated or not tied to action. The checks below are what a compliance lead can run before an inquiry arrives, and they connect back to the 45 CFR 164.308(a)(1)(ii)(A) requirement the cases cite.
Confirm every ePHI system is in scope
Check that the analysis covers every system that creates, receives, maintains or transmits ePHI, including cloud tenants, SaaS applications, backup repositories and medical devices with network access. OCR's imaging case involved medical images on a PACS server reachable from the Internet, which a scope list built from core hospital systems would have missed. Compare the analysis scope against your asset inventory and flag any gap as an open item.
Confirm the analysis is dated and current
Verify the analysis has a date, a version and a record of what changed since the last review, such as a new EHR, a cloud migration or a merger. Several resolved cases involved organizations that had never completed a risk analysis, and HIPAA sets no fixed interval, so the trigger is material change. Keep the prior versions so you can show the history of updates.
Link findings to owned risk management
Each risk rated above your acceptable level should map to a measure in the risk management plan, with a named owner, a target date and a record of completion. OCR's corrective action plans, including Ambry Genetics' two-year plan that started with a new risk analysis and risk management plan, show regulators expect this chain. A list of findings with no owners or dates is the pattern to avoid.
Test breach notification timelines
Run a tabletop exercise that walks an exposed-data scenario through detection, the four-factor risk assessment and notification to individuals. Vision Upright MRI's case turned on notification falling outside the 60-day window, and Assured Imaging's on late breach notification after ransomware. Record the exercise date, participants and gaps found.
Confirm the business associate inventory
Check that every vendor holding or processing ePHI is listed, has a current business associate agreement and appears in the risk analysis. Consociate Health was itself a business associate cited for a missing risk analysis after a phishing compromise, so vendors can be the weak link in your chain. Include subcontractors where your vendors use them.
Retain evidence of review
Keep signed review records, meeting minutes, change tickets and the analysis versions for at least six years, which is the documentation retention period the rule sets. Assessors and OCR investigators ask for proof the analysis was performed and acted on, not just a final document. Store these records where they can be produced quickly, and confirm access with your legal and records teams. The free HHS Security Risk Assessment Tool can help structure the analysis, but it does not replace clinical, technical and legal judgment about your environment.
Who owns the risk analysis and who can help
The covered entity or business associate owns the risk analysis, its conclusions and the decisions that follow from them. That ownership is what OCR examines in every settlement in this group: the Security Rule places the obligation to conduct an accurate and thorough assessment on the organization holding the ePHI, not on whoever helped build the systems. Before engaging anyone, name an internal owner, usually the security official, who signs off on scope, accepts or rejects each finding and approves the risk management plan. An implementation partner can speed up the work, but it cannot accept risk on your behalf.
An implementation partner such as DeployOpen can prepare the inputs a risk analysis depends on. On self-hosted open-source platforms inside your own cloud accounts or data centers, that work includes building system and ePHI inventories, running configuration and vulnerability scans, documenting data flows, hardening systems against the findings, and collecting evidence of each change. Scope, deliverables and timelines should be agreed in writing before work starts, and the quote should separate preparation work from any remediation that your own staff will need to verify. Confirm who holds the scan outputs and inventories after the engagement ends.
Only an independent assessor or auditor reports on testing results, and there is no HIPAA certificate. HHS states that no Security Rule standard requires certification and that it does not recognize private certifications, so any vendor or firm offering a HIPAA certificate is offering something the rule does not provide. Ask any third party for the scope of its assessment, the testing it performed and the limits it states in writing. Finally, OCR, not any vendor, consultant or auditor, determines enforcement outcomes. Resolution amounts and corrective action plans in the cases above were set by OCR, so a vendor's assurance cannot predict or reduce your exposure.
Questions buyers ask about HIPAA risk analysis enforcement
What does a HIPAA risk analysis cost, and is the free HHS tool enough?
The cost depends on how many systems, sites and ePHI flows are in scope, how current your asset inventory is, and whether your staff or an outside party does the work. The HHS OCR guidance on risk analysis explains what a compliant analysis must cover, and the free HHS Security Risk Assessment Tool can structure the work. The tool does not verify technical controls, interview staff, test systems or write your risk management plan. For a small practice with simple systems it may be a reasonable starting point. A hospital, health plan or business associate with cloud services and several applications usually needs more. Ask any consultant for a written scope that names the systems covered, the interviews and testing included, and the deliverables, and confirm the fit against your own environment before you commit.
How long does a settlement corrective action plan last?
A corrective action plan runs for the term written into its resolution agreement, and the terms differ by case. In the Ambry Genetics settlement announced September 17, 2026, the plan runs two years and begins with a new risk analysis and a risk management plan, so the first deliverable is a current analysis rather than a policy update. Ambry paid $700,000 after OCR cited failure to conduct an accurate and thorough risk analysis. Read the agreement in your own matter for its specific obligations, reporting duties and deadlines. Organizations that keep a current risk analysis before any OCR contact face less work under a fixed timetable. Ask health care counsel to confirm which duties would apply to your organization.
Does a third-party HIPAA assessment prevent an OCR finding?
No. A third-party assessment does not prevent an OCR finding. HHS states that no Security Rule standard requires certification, that it does not endorse or recognize private certifications, and that such certifications do not stop HHS from later finding a violation. An outside assessor can test your analysis, challenge gaps and produce evidence, which lowers the chance that material risks are missed. The covered entity or business associate still owns the risk analysis, its decisions and its compliance. Ask any assessor to show its method, the systems it tested and the findings it has not resolved. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Only independent auditors and certification bodies issue those.
What must an organization provide during an OCR audit?
Expect OCR to ask for written evidence that the Security Rule operates in practice, not verbal assurances. The HHS OCR audit program page describes the 2024 to 2025 audits, which review 50 covered entities and business associates on the provisions most relevant to hacking and ransomware. Prepare a dated risk analysis, the risk management plan that acts on its findings, a current ePHI inventory and data-flow map, written policies and procedures, workforce training records, access and audit log samples, incident response and contingency plans, and business associate agreements. Keep each document retrievable and dated, because a control that cannot be shown is treated as missing. Confirm the exact request list against the notice you receive, since the requests can change.
Does a business associate face the same penalty exposure as a covered entity?
A business associate is directly bound by the Security Rule for the ePHI it handles, as set out in 45 CFR 164.302, so it cannot rely on the covered entity's risk analysis to satisfy its own duties. OCR's enforcement record shows business associates are settled too. Consociate Health, a business associate providing health plan administration, paid $225,000 in December 2025 after a January 2021 ransomware attack, and OCR cited failure to conduct a risk analysis. The penalty ranges in 45 CFR 102.3 are written for HIPAA violations generally, so confirm with counsel how they apply to your role. Your exposure depends on the violations found, the culpability level and the corrective steps taken. Review your business associate agreements to see which duties your contract assigns and which the rule places on you directly.
How do HIPAA penalty ranges compare with OCR settlement amounts?
The penalty ranges are ceilings, and settlements have fallen well below them. For penalties assessed on or after January 28, 2026, the inflation-adjusted amount under 45 CFR 102.3 runs from $145 per violation with no knowledge to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294. Settlements in the OCR record range from $25,000, paid by Vision Upright MRI in May 2025, to $700,000, paid by Ambry Genetics in September 2026. Negotiated amounts reflect the violations found, the number of individuals affected, the culpability level and the corrective effort. Ask counsel to model your exposure per violation and per calendar year, and treat the headline settlement figures as one data point rather than a forecast of your own outcome.
How DeployOpen prepares risk analysis evidence
OCR's settlements repeatedly cite a missing or inaccurate risk analysis, so DeployOpen treats the analysis as the first evidence an assessor will ask for. We prepare the systems, inventories and records that let your organization conduct and document its own analysis, while the analysis and its conclusions remain your responsibility.
How we scope
- Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
- The written scope names which ePHI systems, locations and business associates the risk analysis will cover.
- Scope also states what your team owns, such as the risk decisions, sign-offs and the designated security official role.
How we build
- We help build the inventory of systems that create, receive, maintain or transmit ePHI, with data flows mapped.
- Security testing of in-scope applications, APIs and infrastructure feeds findings into the risk analysis as documented evidence.
- We draft the risk management plan records that show how each identified risk is reduced to a reasonable and appropriate level.
How we hand over
- You receive the inventory, data-flow maps, test results and risk records in editable formats your team can maintain.
- Documentation covers what was analyzed, the method used, the date, and who approved each decision.
- We walk your team through the handover so the records can be updated when systems or operations change.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers for keeping the risk analysis current.
- Retainer work can refresh the inventory and retest systems after material changes to the environment.
- DeployOpen does not issue audit reports, attestations or certifications. Confirm with your own OCR counsel or independent assessor what evidence they will accept.
