Walk into almost any clinic, home-health agency, or small practice and ask to see their HIPAA compliance. Someone will produce a binder — or a folder on a shared drive — containing a risk assessment. It might be thorough. It might be three years old. Either way, the person handing it to you believes it is a shield. In 2026, it is closer to a confession.
The U.S. Department of Health and Human Services' Office for Civil Rights (OCR) has sharpened its enforcement focus onto risk analysis and risk management, and the emphasis on that second word is the whole story. OCR now expects regulated entities to prove not just that they identified risks, but that they acted on them — with documented remediation and ongoing management (Clearwater, HIPAA Journal).
The thesis
A risk assessment is not evidence of compliance. It is evidence of awareness. And awareness without action is precisely what OCR now punishes. The moment you document a risk and then do nothing about it, you haven't protected yourself — you've created a signed, dated record that you knew about a vulnerability and left it open. Your binder doesn't prove you were careful. It proves what you knew and when you knew it.
The binder was never the work. The binder was the to-do list. Somewhere along the way, we started filing the to-do list as if it were the finished job.
Why the ground shifted
This isn't regulators being pedantic. In 2025 a new record was set for large healthcare data breaches, and in each of the past three years the protected health information of more than 100 million people was exposed. When breaches at that scale keep repeating, "we assessed our risk" stops being a meaningful defense — because everybody assessed their risk, and the records still walked out the door. The only thing that separates a breached organization that gets penalized from one that doesn't is demonstrable remediation: the ticket you closed, the policy you updated, the access you revoked, the vendor you re-vetted.
The honest counterpoint
Two fair objections. First: a risk analysis is genuinely required and genuinely useful — this isn't an argument for skipping it, and a good assessment is the foundation everything else is built on. Second: small and rural providers are being asked to shoulder real cost here. Industry groups warned that the broader Security Rule overhaul could carry a roughly $9 billion first-year price tag and hit small practices hardest, and final action on that rule has been pushed out to at least 2027 (HIPAA Journal). Both are true. But neither rescues the binder-as-shield mindset. The point isn't "do more expensive paperwork." The point is that the cheapest, most protective thing you can do with a risk you've already found is fix it and write down that you fixed it — and that costs less than the assessment did.
What "acting on it" actually looks like
A remediation trail: every identified risk has a status — open, in progress, resolved — with a date and a name attached.
Ongoing management, not an annual event: risk review is a recurring habit, not a document you regenerate the week before an audit.
Proof you can hand over cold: if OCR asked tomorrow, you could show the closed tickets, the updated policies, the revoked access — not just the assessment that named the problem.
Honest scoping: a small practice's plan should be small — but real. A one-page living tracker beats a fifty-page binder nobody has opened since it was signed.
Where FHC stands
HIPAA consulting is one of the four things we actually do. We're not here to sell you a thicker binder — we're here to help you turn the risks you've already found into a remediation trail that would survive an audit. If you're not sure yours would, that uncertainty is the answer. Message us and we'll walk through where you stand.
This is an opinion piece reflecting FHC's perspective on current enforcement trends. It is general information, not legal advice. Regulatory requirements vary by organization; consult qualified counsel for your specific situation.
Sources
HIPAA Security Rule Enforcement: Where Things Stand in 2026 — Clearwater
New HIPAA Regulations in 2026 — HIPAA Journal
HIPAA Updates and HIPAA Changes in 2026 — HIPAA Journal
