On April 23, 2026, the HHS Office for Civil Rights announced four financial penalties at once. All four followed ransomware attacks. Between them, the electronic protected health information of roughly 427,000 people was exposed, the entities paid $1,165,000, and each accepted a corrective action plan under OCR monitoring for two years (HHS). Including those four, OCR has resolved six investigations with penalties in 2026, collecting $1,278,000 (HIPAA Journal).
Now read what they were actually cited for. Most of these trace back to the Risk Analysis Initiative that OCR launched in 2024 — an enforcement program built specifically around one requirement: the security risk analysis that the HIPAA Security Rule has demanded since 2005 (Healthcare Compliance Pros).
The thesis
The current enforcement regime punishes missing paperwork far more reliably than it punishes weak security — and small providers have responded exactly the way you would expect. They buy a template.
Think about the incentive from inside a five-person home health agency. You have limited money and no IT staff. You learn that OCR fines people for not having a risk analysis. What is the rational move? Not hardening your systems — that costs real money, takes months, and produces nothing you can hand an investigator. The rational move is to purchase a document, put it in a binder, and get back to seeing patients.
A compliance industry grew up selling the artifact, because the artifact is what gets audited.
And it works, in the narrow sense. A dated document with your name on it answers the first question OCR asks. Whether anyone acted on a single finding inside it is a much harder thing for an investigator to assess — and a much easier thing for a busy agency to skip.
What OCR actually asks
THE QUESTION | WHAT A TEMPLATE CAN'T ANSWER |
|---|
Do you have a risk analysis? | Nothing — a template passes this one. |
What date is on it? | Whether it reflects the systems you use now. |
Does it cover phones and email? | Where small-provider ePHI actually lives. |
What did you do about what it found? | This is the one that fails people. |
A risk you documented and then ignored is worse than one you never looked for. It proves you knew.
The honest counterpoint
OCR is not wrong, and the case against my own argument is strong. You cannot protect what you have not inventoried. The risk analysis is the one requirement that scales identically for a hospital system and a three-nurse agency: both have to know where the data is, who can reach it, and what could go wrong. There is no smaller version of that question.
And several of the sanctioned attacks exploited weaknesses that an honest analysis would have surfaced — unpatched systems, shared credentials, no multi-factor authentication on remote access. In those cases the missing document and the missing security were the same failure wearing two names. Fining the paperwork was, functionally, fining the negligence.
The counterargument I can't dismiss: if OCR only pursued cases where it could prove a specific technical control caused a specific breach, enforcement would collapse into forensic litigation and almost nothing would ever be sanctioned. The risk analysis is the enforceable proxy. Proxies are imperfect by definition — that's not a reason to abandon them.
What would make it better
Audit the remediation, not just the document. Ask for the analysis and for evidence that one finding in it was closed. That single follow-up question would end the template industry overnight.
Publish a free reference analysis for small providers. If the state or OCR wants every licensed provider to have one, giving them a real starting point costs almost nothing and raises the floor immediately.
Scale the penalty to capacity, not to headcount of records. A $375,000 penalty is a rounding error to a health system and an extinction event to a home care agency — for the same finding.
Say plainly that the analysis is required. Most small providers who don't have one aren't defying the rule. They have never been told it exists.
IF YOU'RE A SMALL PROVIDER READING THIS
The uncomfortable practical truth is that the document is required either way. Get it done — but do the version where you actually walk the building, list the phones, ask who has the passwords, and fix one thing. That version protects you twice.
Where FHC stands
We do HIPAA consulting and risk management consulting, so our bias is on the table: enforcement like this creates work for people who do what we do. That's exactly why we'd rather argue for the version that improves security than the version that improves filing. If you can't name the date on your risk analysis, that's the gap — message us and we'll talk through it.
This is an opinion piece reflecting FHC's perspective. It is general information, not legal advice. Consult qualified counsel regarding your obligations under HIPAA and Florida law.
Sources
HHS' Office for Civil Rights Settles Four HIPAA Security Rule Ransomware Investigations — HHS.gov
OCR Fines Four Regulated Entities for HIPAA Violations That Led to Ransomware Attacks — HIPAA Journal
HIPAA Risk Analysis Enforcement in 2026 — Healthcare Compliance Pros
Resolution Agreements — HHS.gov
