Your Clinic Has a HIPAA Risk Analysis. Would It Pass an OCR Review?

A binder on the shelf is not a risk analysis

Ask a clinic manager whether they have a HIPAA risk analysis and the answer is usually yes. Then ask when it was last updated, whether it covers the new patient portal and who owns the plan that came out of it. The answers often get quiet.

That gap is exactly what federal investigators are finding. When a breach is reported, they ask for the risk analysis. More and more often, what they get back does not hold up.

What the evidence says

On April 23, 2026 the HHS Office for Civil Rights announced settlements with four organizations after separate ransomware attacks. Together the breaches affected more than 427,000 people, and the four paid a total of $1,165,000. A women's health network paid $320,000 after a breach affecting 37,989 people. A medical imaging provider paid $375,000 after 244,813 people were affected. A benefits administrator working as a business associate paid $225,000 after 136,539 people were affected, in an attack that began with a phishing email in July 2020. An employer health plan paid $245,000 after 9,316 people were affected. In all four cases, OCR found a failure to conduct an accurate and thorough risk analysis.

OCR Director Paula M. Stannard said hacking and ransomware are the most frequent type of large breach reported to OCR. The release said the four cases brought OCR to 19 completed ransomware investigations and 13 completed investigations under its Risk Analysis Initiative.

Smaller organizations are not exempt. In February 2026 OCR settled with a substance use treatment provider in Illinois after a phishing attack on one staff email account exposed data on 1,980 patients. It paid $103,000 and agreed to two years of monitoring. In August 2025 OCR settled with an accounting firm that received patient data from a health care client as a business associate. That firm paid $175,000 after a ransomware attack, and OCR again cited the missing risk analysis.

In each release, OCR lists the steps it recommends. The first is to identify where electronic patient data is located, including how it enters, flows through and leaves the organization's systems. The second is to conduct and update a risk analysis and act on what it finds.

Why risk analyses fall short

Nobody mapped where the data actually goes

Patient data does not stay in the health record system. It lands in email, scanned faxes, billing exports, spreadsheets, imaging servers, backups and vendor portals. A risk analysis that only looks at the main system misses most of the places attackers get in.

It was a one time project

Practices add locations, switch software and bring on new vendors. A risk analysis written before those changes no longer describes the business that exists today.

Findings never turned into fixes

A list of risks with no owner, no deadline and no follow up does little good. OCR asks for a risk management plan that addresses what the analysis found.

How to build a risk analysis that holds up

1. 1List every system, device, mailbox, file share, backup and vendor that stores or touches patient data.
2. 2Draw how patient data enters your organization, where it moves and where it leaves, including exports and email.
3. 3For each place, note the threats that matter most, such as phishing, ransomware, lost devices and misused access.
4. 4Rate how likely and how harmful each risk is so you know what to fix first.
5. 5Turn the top risks into a written plan with an owner and a date for each fix.
6. 6Turn on audit logs, review system activity on a schedule and require strong login checks for anyone who reaches patient data.
7. 7Update the analysis every year and whenever you add a location, a major system or a new vendor.

A good risk analysis is not a long document for its own sake. It is a clear picture of where patient data lives and an honest plan to protect it, kept current as the business changes.

What this means if you run a company in Oklahoma

Oklahoma has many independent clinics, rural hospitals, dental and therapy practices and the billing, IT and accounting firms that support them. Many run lean, with one office manager carrying compliance on top of everything else.

That is the setting where a risk analysis tends to go stale. The cases above show that the cost of a breach includes not just the attack itself, but a settlement, two years of federal monitoring and the work of doing the analysis properly after the fact.

At Oklahoma Data Partners, we help Oklahoma health care providers and their business associates map where patient data lives, find the gaps that matter and build a plan their staff can actually follow. If your risk analysis has not been updated in a while, book a consultation.