OCR’s Risk Analysis Initiative is now in its second year, and the 2026 settlement docket is clear: the single most-cited finding across HIPAA enforcement is a missing or inadequate risk analysis. Here is what the Initiative is, what the 2026 cases found, and what makes a risk analysis actually hold up.
What the Risk Analysis Initiative is
In October 2024, OCR announced that it was prioritising enforcement against covered entities and business associates failing to conduct the risk analysis required by §164.308(a)(1)(ii)(A). The Initiative is not a new rule — the risk analysis has been required since the Security Rule took effect in 2005 — but it is a visible shift in enforcement emphasis. Each announced settlement under the Initiative explicitly cites the risk analysis failure as a finding.
As of October 2026, OCR has publicly tagged fourteen Initiative settlements. The pattern across them is almost monotonous.
The 2026 settlements that defined the pattern
19 February 2026 — Top of the World Ranch Treatment Centers, $103,000. The eleventh Risk Analysis Initiative action. OCR’s findings: no accurate and thorough risk analysis of ePHI, incomplete workforce security training records, and no formal risk management plan.
23 April 2026 — four ransomware settlements, $1,165,000 total, 427,000+ individuals affected. Four separate ransomware-driven settlements announced together. Each one cited the missing risk analysis as a finding, alongside the specific technical and administrative controls each organisation had failed to maintain.
21 July 2026 — Health plan settlement. OCR’s twentieth ransomware action and fourteenth Risk Analysis Initiative action, per the Nixon Peabody summary. The findings continued the pattern: no risk analysis commensurate with the health plan’s scale, inadequate monitoring, and inadequate response.
17 September 2026 — Ambry Genetics, $700,000, 225,370 individuals affected. A phishing-driven breach. Findings: inadequate risk analysis, incomplete access termination, inadequate unique user identification, and insufficient audit controls. The resolution agreement attached a two-year corrective action plan with OCR monitoring.
The HHS resolution agreements page (last reviewed 9 October 2026) is the authoritative list and worth bookmarking.
The findings that repeat
Three findings appear in nearly every 2026 settlement, Initiative or not:
The risk analysis. Missing entirely, or present but inadequate — covering only part of the environment, not asset-based, not scored, not refreshed since the last incident. OCR cites §164.308(a)(1)(ii)(A).
Access termination. Workforce members retained ePHI access after their roles ended or they left the organisation. OCR cites §164.308(a)(3)(ii)(C). The evidence is often an identity-provider record showing an account enabled after an HRIS termination date — a specific, timestamped gap OCR can quote.
Unique user identification and authentication. Shared service accounts or shared credentials in use for ePHI-adjacent systems, with no clear workforce-member-to-action trail. OCR cites §164.312(a)(2)(i) and §164.312(d).
The Ambry Genetics case cited all three. The ransomware cases cited the risk analysis plus whatever technical gap enabled the ransomware. The Top of the World Ranch case cited the risk analysis plus workforce training records. The common thread is paperwork and process, not advanced attack vectors.
What a corrective action plan asks for
Every Initiative settlement attaches a corrective action plan (CAP). The structure has been consistent across 2026:
- A fresh, enterprise-wide risk analysis within a defined window (usually 90 to 180 days).
- A dated risk management plan addressing every finding, with owners and target dates.
- Updated policies and procedures, filed with HHS.
- Workforce training records covering the training that should have existed.
- Dated attestation of compliance, usually quarterly, for two or three years.
- OCR monitoring and reporting rights throughout the CAP period.
Practitioners will tell you that running a CAP typically costs more than the settlement cheque. The ongoing OCR interaction, the external support, the time cost of producing dated reports every quarter — those compound.
What makes a risk analysis hold up
Four properties separate a defensible risk analysis from an Initiative finding.
Asset-based. Every system, device, service, and media type that creates, receives, maintains, or transmits ePHI is in scope and named. A risk analysis built from a questionnaire rather than an inventory is incomplete by construction, and OCR has treated it that way.
Threat-paired. Each asset is paired with the credible threats to it — ransomware, insider error, lost device, phishing, misconfigured service. The pairing is explicit, not implied.
Scored with a stated methodology. Likelihood and impact are rated against a published method, so a reviewer can reproduce the scoring from the inputs. Any method is acceptable; “we felt this was medium” is not.
Dated and current. The analysis has a date; it has been refreshed within the last twelve months, or after a material change; and prior versions are retained, so year-over-year drift is visible.
For the full plain-language guide, see HIPAA Risk Analysis. For the step-by-step walk, see How to do a HIPAA risk analysis. For a fixed-fee delivered-by-us version with the above properties built in, see the HIPAA Risk Analysis service.
A short checklist against the 2026 pattern
Score your current risk analysis against five questions:
- Does the scope name every system, device, and service that touches ePHI?
- Does each asset have at least one credible threat paired to it?
- Is there a published scoring methodology, or just free-text risk descriptions?
- Is the current version dated within the last twelve months?
- Does a risk management plan exist alongside it, with owners and target dates?
If any answer is no, that is the gap OCR will find. The good news is that each is a weekend of work for a motivated owner, not a quarter.
The bottom line
OCR’s enforcement priorities are not a secret and the 2026 settlements have made them explicit. The organisations that are not on the list did not escape attention — they produced a current, asset-based, threat-paired, dated risk analysis when the investigation asked for one. That one artefact, done properly, is the cheapest insurance against the single most common HIPAA finding.
If you want to know whether yours would hold up, our free readiness assessment scores it in eight minutes.