The Fine Is Rarely for the Breach
There is a persistent misconception that HIPAA fines are punishment for getting breached. They are not. A breach is what opens the investigation, but the penalty almost always lands on something OCR finds during that investigation — a security failure that existed long before the attacker showed up. Read the 2026 enforcement actions in sequence and one phrase recurs with almost monotonous regularity: the organization failed to conduct an accurate and thorough risk analysis. The breach got OCR's attention. The missing risk analysis got the check written.
April 2026: Four Ransomware Settlements, One Diagnosis
On April 24, 2026, OCR announced settlements with four regulated entities following separate ransomware investigations, collectively affecting more than 427,000 individuals and totaling $1,165,000 in payments. The entities span the breadth of the healthcare ecosystem — an imaging provider, a women's health group, an employer health benefits plan, and a third-party administrator:
- Assured Imaging — $375,000. OCR noted the entity was unable to provide evidence that a risk analysis had ever been completed.
- Regional Women's Health Group (Axia Women's Health) — $320,000, for failing to conduct a comprehensive and accurate risk analysis.
- Star Group, L.P. Health Benefits Plan — $245,000, for failing to perform an accurate and thorough assessment of risks and vulnerabilities.
- Consociate Health — $225,000, for the same core failure.
Every one of the four was cited for the same root cause, and every one agreed to a corrective action plan that OCR will monitor for two years. Four different organizations, four different attacks, one identical finding. That is not a coincidence — it is OCR telling the industry exactly what it is looking for.
The Risk Analysis Initiative Is the Through-Line
These settlements are not isolated. They are part of OCR's Risk Analysis Initiative, a deliberate enforcement focus that has now produced well over a dozen actions, including sixteen resolution agreements across 2025 and additional settlements in early 2026. Two from earlier this year show the breadth of who is in scope:
- In February 2026, the initiative's eleventh action settled with Top of the World Ranch Treatment Center, an Illinois substance use disorder provider, after a phishing attack compromised a workforce member's email account — again rooted in an inadequate risk analysis.
- The twelfth action involved MMG Fusion, a dental practice management software company, cited not only for an inadequate risk analysis but also for impermissible disclosure of PHI and for failing to notify affected covered entities of a breach within the required 60 days.
The MMG case is a useful reminder for any practice that relies on vendors: when your business associate is breached, the clock and the obligations flow downstream to you. And OCR has signaled that the initiative is widening from risk analysis to risk management — not just whether you identified your risks, but whether you actually did anything about them afterward.
What These Cases Have in Common (and What They Don't)
What is striking about the 2026 docket is what is absent from it. None of these penalties hinge on the sophistication of the attack. None of them required a brilliant adversary or a novel exploit. The common thread is an organization that could not produce evidence of a basic, foundational control — a current, comprehensive risk analysis — that the Security Rule has required since its inception. The attackers varied. The diagnosis did not.
It is also worth noting the size and type of the penalized entities: a treatment center, a software vendor, a benefits plan, an imaging provider. This is not exclusively Fortune 500 enforcement. Small and mid-sized organizations are squarely in the data, and the dollar amounts — six figures, with two years of federal oversight attached — are existential for a small practice in a way they are not for a hospital system.
The One Thing to Take From This
If you read only one sentence of this post, read this one: the single most effective thing you can do to stay off OCR's list is to have a current, accurate, comprehensive risk analysis — and to act on what it tells you. Not a risk analysis from three years ago. Not a template with your logo on it. A real assessment that reflects your organization as it exists today, with documented evidence that the high risks it identified are actually being remediated over time.
"Current" is the word that matters. The most-cited deficiency is not the total absence of a risk analysis — it is a stale one that no longer reflects the systems, vendors, and exposures the organization actually has. If you have never done a formal one, you can start this week. If yours predates your current vendor list or your last EHR change, treat updating it as the highest-leverage compliance work on your desk. Everything in the 2026 enforcement record says it is.
Related Reading
- HIPAA breaches in 2026: what happened
- A practical guide to the HIPAA risk assessment
- No risk assessment yet? Start this week
- The mid-year HIPAA compliance check
Call to Action
Could you produce a current, defensible risk analysis if OCR asked tomorrow? Schedule a walkthrough to see how HIPAA Security Suite keeps your risk analysis current and your remediation documented, or take the 3-minute readiness quiz to find the gaps OCR would find first.