OCR’s 2026 Enforcement Playbook: 8 Settlements, $2.3M, and Every One Traced Back to a Risk Analysis Failure
The message from the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) is direct: HIPAA risk analysis is now an enforcement priority: not a paperwork exercise.
In 2026, OCR has announced eight HIPAA settlements totaling $2,280,250, commonly rounded to approximately $2.3 million. Every case cited a failure to conduct an accurate and thorough risk analysis under 45 C.F.R. § 164.308(a)(1)(ii)(A).
The organizations involved were not limited to large hospital systems. OCR’s actions reached healthcare providers, a health plan, a business associate, and other organizations that handle protected health information (PHI).
The enforcement pattern is clear: when an organization cannot prove that it identified, evaluated, and addressed risks to electronic protected health information (ePHI), OCR can impose a financial settlement and require years of corrective action.
THE ENFORCEMENT SIGNAL: RISK ANALYSIS COMES FIRST
HIPAA requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
That means more than maintaining policies. It means understanding:
- Where ePHI is created, received, maintained, and transmitted
- Which systems, applications, devices, and cloud services handle ePHI
- How employees, vendors, and business associates access that information
- Which threats could compromise confidentiality, integrity, or availability
- Which vulnerabilities make exploitation more likely
- How identified risks are prioritized and mitigated
OCR’s recent settlements show what happens when that process is missing, incomplete, outdated, or disconnected from actual remediation.
2026 OCR SETTLEMENTS AT A GLANCE
The exact eight-case total is $2,280,250. The dollar amount matters, but the corrective action requirements may create the greater long-term burden.
CASE STUDY 1: OSF HEALTHCARE : $552,250
In July 2026, OCR announced a $552,250 settlement with OSF Healthcare System and affiliated covered entities following a ransomware incident involving the Nephilim ransomware variant.
The incident affected the PHI of approximately 53,907 individuals. OCR found that OSF:
- Failed to conduct an accurate and thorough risk analysis
- Experienced an impermissible disclosure of PHI
- Failed to provide timely notice to affected individuals
- Failed to provide timely notice to HHS
OCR’s resolution agreement emphasized an important breach-response principle: the 60-day notification clock begins when the breach is discovered: not when the forensic investigation is fully complete.
OSF’s corrective action plan required a comprehensive risk analysis covering equipment, systems, applications, cloud environments, off-site storage, and relevant web technologies. The organization also had to create a complete inventory and submit its risk analysis scope and methodology to OCR.
The lesson: A risk analysis must reflect the real environment: not just the systems an organization remembers to include.
Read the official OSF Healthcare resolution agreement and corrective action plan.
CASE STUDY 2: SPENCER GIFTS : $450,000
In June 2026, OCR announced a $450,000 settlement with the Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans.
A November 2021 ransomware incident affected ePHI associated with approximately 10,023 plan members. Although Spencer Gifts is best known as a retail company, its employee health plan operated as a HIPAA-covered health plan.
OCR identified failures involving:
- The required risk analysis
- HIPAA Privacy Rule policies and procedures
- HIPAA Security Rule policies and procedures
- HIPAA Breach Notification Rule policies and procedures
The corrective action plan required the health plan to conduct a comprehensive risk analysis, develop a risk management plan, update policies and procedures, distribute them to workforce members, and provide training.
The lesson: HIPAA responsibilities can apply to organizations that do not consider themselves healthcare providers. Health plans, business associates, and other supporting organizations remain accountable when they handle ePHI.
Review the HHS OCR enforcement agreement index for the Spencer Gifts resolution documents.
CASE STUDY 3: APRIL’S FOUR-ENTITY RANSOMWARE SWEEP : $1.165 MILLION
In April 2026, OCR announced four ransomware-related HIPAA settlements totaling approximately $1.165 million.
The enforcement group included:
- BST & Co., a business associate
- Guam Memorial Hospital Authority
- Syracuse ASC
- SG Health Plan
Although the entities differed in size and role, OCR’s findings followed the same pattern: inadequate risk analysis and insufficient risk management.
OCR’s corrective action requirements included activities such as:
- Completing an accurate and thorough risk analysis
- Developing and implementing a risk management plan
- Reviewing audit logs and access reports
- Improving security incident tracking
- Updating written policies and procedures
- Strengthening controls related to ransomware and unauthorized access
The lesson: OCR is not treating ransomware as an isolated technical event. The agency is examining whether the organization had a documented, repeatable process for identifying and mitigating foreseeable risks before the incident occurred.
Read OCR’s announcement regarding the four ransomware investigations.
CASE STUDY 4: TOP OF THE WORLD RANCH : $103,000
In February 2026, OCR announced a $103,000 settlement with Top of the World Ranch Treatment Center, an Illinois substance use disorder provider.
The matter began with a March 2023 phishing incident in which an unauthorized third party accessed a workforce member’s email account. The breach affected ePHI belonging to approximately 1,980 patients.
OCR’s central finding was not simply that a phishing attack occurred. The agency found that the organization had failed to conduct an accurate and thorough risk analysis.
The corrective action plan required:
- A comprehensive risk analysis
- A risk management plan
- Written HIPAA policies and procedures
- Annual workforce training
- Ongoing compliance documentation
The lesson: A smaller organization does not receive a smaller compliance obligation. OCR’s risk analysis initiative reaches providers of varying sizes.
OCR’S PATTERN: FINDINGS BECOME CORRECTIVE ACTION PLANS
OCR settlements typically require much more than a payment.
Organizations may be required to complete a multi-year corrective action plan that includes:
- A new or revised risk analysis covering the entire ePHI environment
- A documented risk management plan with mitigation priorities and timelines
- Asset inventories and data-flow documentation
- Updated privacy, security, and breach notification policies
- Workforce training and acknowledgment records
- Audit log reviews and security monitoring
- Incident response and contingency planning
- Periodic reports to OCR demonstrating progress
This is why an incomplete risk analysis creates more than an audit gap. It can become the foundation for regulatory oversight, additional operating costs, and prolonged executive attention.
THE PROPOSED HIPAA SECURITY RULE AMENDMENTS RAISE THE BAR
The current HIPAA Security Rule already requires an accurate and thorough risk analysis. However, OCR’s proposed Security Rule amendments would make the process more prescriptive if finalized.
The proposed changes would require organizations to maintain and use:
- A written technology asset inventory
- A network map showing how ePHI moves through systems
- Documentation of reasonably anticipated threats
- Identification of vulnerabilities and predisposing conditions
- Risk assessments based on threat-vulnerability pairs
- At least annual risk analysis activities
- Updates after material changes, new threats, or security incidents
- Stronger integration with vulnerability management, incident response, and contingency planning
The proposed amendments are not yet final and are not currently enforceable as written. Organizations remain subject to the existing HIPAA Security Rule.
Still, the direction is unmistakable: risk analysis is becoming the central organizing mechanism for security and compliance.
Waiting for the rule to become final is a poor risk strategy. Build the discipline now.
Review the HHS fact sheet on the proposed HIPAA Security Rule amendments.
WHAT A DEFENSIBLE HIPAA SRA SHOULD PRODUCE
A defensible Security Risk Assessment should produce more than a completed questionnaire or a signed PDF.
Your organization should be able to demonstrate:
- A complete inventory of systems and devices
- A documented ePHI data flow
- Identified threats and vulnerabilities
- Likelihood and impact ratings
- Business and clinical context for prioritization
- Assigned remediation owners
- Target completion dates
- Evidence that remediation was tracked and validated
- A process for updating the assessment as the environment changes
This is where risk analysis must connect to operational security.
Cenova Cyber’s HIPAA compliance services help healthcare organizations and business associates identify risk, implement controls, monitor continuously, and maintain audit-ready evidence.
MOVE FROM RISK IDENTIFICATION TO RISK REDUCTION
A risk assessment that does not influence remediation will not protect your organization.
Cenova Cyber’s Vulnerability Management as a Service helps organizations move from finding vulnerabilities to fixing the ones that matter most. Our process includes:
- Asset discovery and baseline inventory
- Internal, external, cloud, and Active Directory scanning
- Risk-based prioritization
- Remediation coordination
- Validation scanning
- Compliance-ready reporting
For healthcare organizations without dedicated security leadership, our vCISO services provide executive-level guidance for risk governance, policy management, incident response planning, remediation oversight, and leadership reporting.
TAKE THE NEXT STEP BEFORE OCR TAKES IT FOR YOU
OCR’s 2026 enforcement record removes the ambiguity:
A missing or inadequate risk analysis can lead to a settlement, a corrective action plan, and years of regulatory oversight.
Do not wait for a ransomware incident, phishing breach, audit request, or cyber insurance renewal to expose the gaps.
Schedule a free HIPAA scoping consultation with Cenova Cyber. We will help you evaluate your current Security Risk Assessment, identify material gaps, and determine the next practical steps toward a defensible risk management program.
Protect patient data. Reduce exposure. Build evidence before you need it.