The finding that shows up most in recent HHS enforcement is a missing or inadequate risk analysis. The Security Rule requires an accurate and thorough assessment of risks to electronic protected health information, and OCR has built a named enforcement initiative around its absence. Fix that first, then check the rest of the administrative safeguards.
What does OCR keep finding?
OCR's Risk Analysis Initiative targets covered entities and business associates that fail to assess risks to ePHI. A law firm summary of OCR announcements describes two settlements in February and March 2026 as the initiative's 11th and 12th enforcement actions, following 16 resolution agreements announced between January and August 2025.
One case involved an Illinois treatment provider after a phishing attack gave access to ePHI through a workforce member's email account. The other involved a software company serving dental practices after PHI appeared on the dark web. OCR found that both failed to conduct an adequate risk analysis. In the second, OCR also found impermissible disclosure of PHI and a failure to notify affected covered entities of the breach. OCR's director said business associates must notify covered entities without unreasonable delay.
These are enforcement cases, not a random audit sample, so they show what OCR pursues rather than a statistical ranking of problems.
What does the rule require?
Section 164.308 of the Security Rule requires covered entities and business associates to conduct "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI, and to implement security measures "sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level." Both are marked required.
The same section lists the other administrative safeguard standards: security management, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, contingency plan, and evaluation.
Where do teams slip?
A risk analysis that is old, partial or generic. A one-off spreadsheet from years ago, or a template that does not name your systems, is hard to defend. The word "thorough" matters: every place ePHI lives, including email, laptops, vendors and backups.
No link from analysis to action. Risk management is its own requirement. A list of risks with no owners or dates shows analysis without management.
Business associate blind spots. The software company case shows that vendors face the same duties, including breach notification to the covered entity.
Workforce access and phishing. One of the cases began with a compromised email account. Training and access controls for ordinary staff matter as much as server hardening.
No test of contingency and evaluation. Backups that were never restored, and policies never reviewed against reality.
What to do
- Inventory every system, device and vendor that creates, receives, stores or transmits ePHI.
- Run a documented risk analysis covering threats, vulnerabilities, likelihood and impact for each.
- Turn each risk into a management decision: fix, accept with sign-off, or transfer, with an owner and due date.
- Repeat the analysis when you add systems or change processes, and on a regular schedule.
- Check business associate agreements and confirm vendors know your breach notification expectations.
- Run phishing training and enforce multi-factor authentication on email and remote access.
- Test a restore from backup and record the result.
- Keep dated evidence of each step, because an investigator will ask for it.
Quick check
Is risk analysis really required, or only recommended?
Required. Section 164.308 lists the risk analysis and risk management implementation specifications as required, not addressable.
Do business associates face the same enforcement?
Yes. OCR's initiative names both covered entities and business associates, and one 2026 settlement involved a software company.
Sources
- 45 CFR 164.308 (Cornell LII), fetched 18 October 2026.
- McDonald Hopkins: OCR announces 11th and 12th Risk Analysis Initiative enforcement actions, fetched 18 October 2026. This is a law firm summary of OCR announcements. Check OCR's own enforcement pages for the original notices.
Last reviewed: 18 October 2026.
