If you read through the HIPAA settlements the HHS Office for Civil Rights (OCR) has announced in 2025, one finding shows up again and again: the organization failed to conduct an accurate and thorough risk analysis. That is not a coincidence. OCR launched its Risk Analysis Initiative in late 2024 specifically to focus enforcement on this requirement, and the initiative has continued under the new administration.
What the settlements show
The 2025 cases cover a wide range of organizations: small specialty practices, hospitals, a national medical supplier that paid a $3 million penalty, and health networks hit by phishing and ransomware. Penalties have ranged from tens of thousands of dollars to seven figures. In many of these cases the breach itself started with a common attack. The enforcement action focused on the fact that the organization had never properly identified where its electronic protected health information (ePHI) lived or what risks it faced.
What OCR expects a risk analysis to cover
- All ePHI, everywhere. EHRs, email, cloud apps, backups, laptops, mobile devices, and systems run by vendors on your behalf.
- Threats and vulnerabilities for each system. Not a generic list, but an assessment tied to how you actually operate.
- Likelihood and impact. A documented risk level for each finding.
- Current safeguards. What is in place today and whether it works.
- Ongoing review. Updates when you add systems, change vendors, move offices, or experience an incident.
A checklist, a vendor questionnaire, or a network scan on its own does not meet this standard. OCR also expects a risk management plan that shows how identified risks are being reduced over time.
Five questions to ask about your own risk analysis
- When was it last updated, and does it reflect the systems you use today?
- Does it include cloud services and business associates that store or access ePHI?
- Does each risk have an owner and a remediation plan with dates?
- Can you show progress on those remediation items since the last assessment?
- Could you hand it to an OCR investigator tomorrow without rewriting it?
How Eagle can help
Security risk assessments are the core of what we do. Eagle has delivered HIPAA risk analyses for providers, business associates, health plans, and Ohio county boards for more than 15 years, and our reports are built to stand up to OCR review. We also provide ongoing IT risk management support to track remediation between assessments. Schedule a consultation to get started.
Sources: National Law Review; Ogletree Deakins.
