The numbers from 2024 are hard to hold in your head. It was the worst year on record for healthcare data breaches: 725 large breaches reported to the HHS Office for Civil Rights, exposing the protected health information of about 289 million people. A single attack — on Change Healthcare, a third-party clearinghouse — accounted for roughly 192.7 million of those records (HIPAA Journal).
The instinct is to file this under "cybercrime is getting worse." True, and comfortable, and beside the point. Because look at what OCR is actually penalizing.
The thesis
Regulators are not, for the most part, fining organizations for being attacked. They are fining them for the risk analysis they never did. As of January 31, 2026, OCR had closed eleven hacking investigations with financial penalties under an enforcement initiative squarely focused on risk-analysis failures, and recent ransomware settlements followed the same script (HIPAA Journal). In other words: the breach opened the door, but the fine was for never having drawn a map of the building. That is a paperwork failure — an unglamorous, entirely preventable one — and we keep choosing not to fix it until someone forces us to.
The hacker got in through the window. The fine was for never checking whether the window locked.
Why this framing matters
Because "we got hacked" invites sympathy, and "we never completed a HIPAA risk analysis" invites accountability — and only one of those changes behavior. A risk analysis is not a document you produce to survive an audit. It is the exercise of knowing, concretely, every place your protected health information lives, every vendor who can reach it, and every way it could leak. The Change Healthcare disaster is the whole argument in one data point: your single largest exposure may not be inside your walls at all. It may be a business associate you onboarded years ago and never reassessed.
The honest counterpoint
Now the fair objection, because a one-sided version of this would be dishonest. No risk analysis on earth stops a determined, well-resourced nation-state attacker. Some breaches are genuinely the result of sophisticated adversaries defeating reasonable defenses, and it is unjust to treat every victim as negligent — that can devolve into punishing organizations twice, once by the attacker and once by the regulator. There is also a real danger of "checkbox compliance," where a thick risk-analysis binder substitutes for actual security. Both cautions are valid.
But neither rescues the organizations OCR actually fined. The penalties in this initiative did not land on victims who did everything right and lost anyway. They landed on entities that could not show they had ever seriously asked where their PHI was and what threatened it. The counterpoint refines the thesis. It doesn't overturn it.
What to actually do
Treat your risk analysis as living, not annual. Re-run it when systems, vendors, or data flows change — not just at renewal.
Map your business associates like attack surface, because that's what they are. Who touches PHI, under what BAA, with what security of their own?
Act on what you find. An identified, undocumented, unaddressed risk is worse in an investigation than one you never spotted.
Assume the vendor is the front door. Change Healthcare wasn't the exception. It was the preview.
Where FHC stands
We would rather help you find the gap than watch OCR find it for you. FHC provides HIPAA consulting and risk management consulting — including the risk analysis this whole enforcement wave keeps rewarding people for skipping. If you can't say, off the top of your head, everywhere your PHI travels, that's the place to start. Talk to us.
This is an opinion piece reflecting FHC's perspective. It is general information, not legal advice; confirm your specific HIPAA obligations with qualified counsel.
Sources
Healthcare Data Breach Statistics (updated 2026) — HIPAA Journal
OCR Fines Four Regulated Entities for HIPAA Violations That Led to Ransomware Attacks — HIPAA Journal
HHS Office for Civil Rights — Breach Portal ("Wall of Shame")
