HIPAA risk analysis: why does OCR keep enforcing it?

What does the HIPAA risk analysis requirement say?

The HIPAA risk analysis requirement in the Security Rule obliges every covered entity and business associate to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic protected health information (ePHI) it holds. That requirement sits at 45 CFR 164.308(a)(1)(ii)(A), and the next provision, 164.308(a)(1)(ii)(B), requires risk management: security measures sufficient to reduce those risks to a reasonable and appropriate level.

The two work as a pair. The risk analysis tells you what could go wrong with ePHI and how badly. Risk management is the record of what you did about it. Many firms and vendors call the first step a HIPAA risk assessment or HIPAA security risk assessment; the regulation's term is risk analysis, and the obligation is the same. Most other Security Rule decisions, including whether an addressable safeguard such as encryption is reasonable for your environment, are supposed to trace back to that analysis. When the analysis is missing or stale, the rest of the program has nothing to stand on.

Why does OCR keep citing the risk analysis?

OCR keeps citing the risk analysis because it is the gap it finds after breach after breach, and the agency now runs a dedicated enforcement program around it. Under its Risk Analysis Initiative, OCR focuses investigations on whether the organization had a compliant risk analysis before the incident. The count has climbed steadily:

• August 18, 2025: BST & Co. CPAs, a New York accounting firm acting as a business associate, paid $175,000 after ransomware reached a client's PHI. OCR called it the 10th Risk Analysis Initiative action.
• February 19, 2026: a treatment center paid $103,000 after a phishing attack on one workforce email account. That was the 11th.
• April 23, 2026: OCR announced four ransomware settlements totaling $1,165,000, including a business associate and an employer health benefits plan, each citing an inadequate risk analysis. OCR put the initiative at 13 completed actions.
• June 18, 2026: a national retailer's employee health benefits plan paid $450,000 after a ransomware attack. OCR called it the 14th action.

OCR's September 17, 2026 settlement with a genetic testing company, for $700,000, again led with the failure to conduct an accurate and thorough risk analysis. OCR Director Paula M. Stannard described a compliant risk analysis, risk management and full implementation of the Security Rule as the foundation for effective cybersecurity.

The practical reason is evidentiary. After a breach, OCR asks for the risk analysis that existed beforehand. Either it exists, covers the system that was compromised and shows a decision about the risk, or it does not. That makes it one of the easiest Security Rule failures to prove.

Does the HIPAA risk analysis requirement apply outside hospitals and clinics?

Yes. It reaches business associates and employer health plans, and both appear in the recent settlements. A law firm handling medical records in litigation, an accounting firm that works with a provider's financial data, or an IT provider hosting a practice's systems is a business associate when it creates, receives, maintains or transmits PHI for a covered entity, and the Security Rule applies to it directly. BST & Co. CPAs and Consociate Health, a benefits administrator in the April settlements, were both business associates.

Employers are reached through their group health plans. Two of the 2026 settlements were with employer-sponsored health benefits plans. If your organization's only PHI exposure comes through a self-insured plan or a client engagement, the risk analysis still has to cover that ePHI. A firm-wide cybersecurity assessment written for another framework does not automatically do so.

What does OCR expect a HIPAA risk analysis to contain?

OCR's Guidance on Risk Analysis lists the elements it looks for, while noting that it is not a one-size-fits-all blueprint. In summary:

• A scope that covers all ePHI the organization creates, receives, maintains or transmits, on any electronic medium.
• Data collection showing where that ePHI is stored, received, maintained or transmitted.
• Documented, reasonably anticipated threats and the vulnerabilities they could exploit.
• An assessment of current security measures, including whether they are configured and used properly.
• The likelihood and potential impact of each threat and vulnerability combination.
• An assigned risk level for each combination, with corrective actions.
• Documentation in any format, and periodic review and updates.

OCR has also said what does not count. Its April 2018 cybersecurity newsletter explained that a gap analysis, which compares existing controls against a list of requirements, does not incorporate these elements and may not satisfy the risk analysis obligation. A vendor questionnaire, a vulnerability scan or a penetration test report is useful input. None of them is the analysis.

Does a HIPAA risk analysis have to be redone every year?

No, the current rule does not set a calendar, but the analysis has to stay accurate. OCR's guidance states that the Security Rule does not specify how frequently to perform a risk analysis and describes it as an ongoing process. 45 CFR 164.316(b) requires security documentation to be reviewed periodically, updated in response to environmental or operational changes, and retained for six years. A new cloud platform, an office move, a shift to remote work or a new client engagement involving PHI can each make last year's analysis inaccurate.

Annual review is common practice because it is the easiest schedule to defend. The proposed Security Rule update published January 6, 2025 would go further, requiring more specific risk analysis contents and a written technology asset inventory and network map reviewed at least every 12 months. That proposal is not final, and the federal regulatory agenda lists final action for July 2027. Our update on where the HIPAA Security Rule overhaul stands covers the timeline.

What do OCR's risk analysis settlements have in common?

In each settlement the breach came first and the risk analysis question came second. The incidents were ordinary: a phished mailbox, ransomware on internal systems, accounts that stayed active after they should have been closed. The Ambry settlement also cited missing procedures to end access when employment ended and the lack of unique user identification. Several of these settlements, including BST and Ambry, came with a corrective action plan monitored by OCR for two years, so the organization completes the work anyway, under supervision and after paying.

OCR's own mitigation list in the February 2026 release is a useful self-check: know where ePHI enters, flows through and leaves your systems; keep the risk analysis current; maintain audit controls and review system activity regularly; authenticate users; encrypt ePHI in transit and at rest where appropriate; feed lessons from incidents back into the program; and give the workforce role-specific HIPAA training.

What should you check in your HIPAA risk analysis this quarter?

• Find your last risk analysis and check its date, its author and its scope. If it predates your current systems, treat it as out of date.
• Map where ePHI actually lives today: email, document management, file shares, cloud storage, backups and vendor platforms.
• Confirm the analysis covers each location with a likelihood, impact and risk level, and a named owner for each remediation item.
• Test the controls OCR keeps citing: audit logs and their review, multifactor authentication and unique user IDs, access removal at termination, and encryption.
• Set the next review date and write down which changes would trigger an earlier one.
• If you are a business associate, confirm your own analysis covers the PHI you hold. Your client's analysis does not cover your systems.

How can s90 help?

s90 helps law firms, accounting firms, nonprofits and employers that handle PHI complete a documented HIPAA risk analysis, track the remediation that follows it, and keep the evidence an investigator would ask for. If your last analysis is more than a year old or was a checklist, we can help you scope a current one.