Ransomware isn’t what gets healthcare providers fined. The risk analysis is.

On September 17, 2026, the HHS Office for Civil Rights announced that Ambry Genetics would pay $700,000 to settle a HIPAA investigation. The cause was one phishing email. An attacker got into a single employee's mailbox and the protected health information of 225,370 people was potentially taken.

The phishing email is the part people remember. It is not the part OCR penalized. The first finding on OCR's list was a failure to conduct an accurate and thorough risk analysis.

I have read through OCR's security settlements from the last two years and my view is this: ransomware and phishing are not what get healthcare providers fined. A missing or shallow risk analysis is.

The attack only opens the file. What OCR finds when it asks for your risk analysis decides how the file closes.

The question OCR asks first

In late 2024, OCR began a Risk Analysis Initiative. Its first action came on October 31, 2024, when Bryan County Ambulance Authority, an Oklahoma EMS provider, agreed to pay $90,000 after a ransomware attack affecting about 14,273 patients. OCR found it had not done a compliant risk analysis.

Since then the count has kept climbing. On June 18, 2026, OCR called its settlement with the Spencer Gifts employee health plan its 14th action under the initiative. Director Paula M. Stannard put it simply in that release: "Effective cybersecurity starts with Security Rule compliance."

The pattern, case by case

Here are the recent cases, all from HHS announcements. Look at who is on the list.

• Comprehensive Neurology, PC (New York), April 25, 2025: $25,000. A small practice hit by ransomware that encrypted all of its ePHI, affecting about 6,800 people. Finding: no accurate and thorough risk analysis.
• Health Fitness Corporation (Illinois), March 21, 2025: $227,816. A server misconfiguration left ePHI discoverable online starting around 2015. OCR found the company had not done an accurate risk analysis until January 2024.
• BST & Co. CPAs (New York), August 18, 2025: $175,000. An accounting firm acting as a business associate, hit by ransomware in December 2019. Same finding.
• Top of the World Ranch Treatment Center (Illinois), February 19, 2026: $103,000. A phishing attack on one email account exposed 1,980 patients. Same finding.
• Four ransomware settlements, April 23, 2026: $1,165,000 combined. A women's health network, an imaging provider, a third-party administrator and a self-funded health plan. All four cited a failure to conduct an accurate and thorough risk analysis.
• OSF Healthcare System, July 29, 2026: $552,250. A 2021 ransomware attack affecting 53,907 people. Findings included an incomplete risk analysis and late breach notices.

Three things stand out.

Size does not protect you. The list runs from a single neurology practice paying $25,000 to a health system paying more than half a million. Business associates such as an accounting firm and a benefits administrator are on it too.

The attack type does not matter. Ransomware, phishing and a simple server misconfiguration all ended with the same finding.

The lag is long. Many of these incidents happened in 2019, 2020 or 2021. Ambry's phishing attack was discovered in January 2020 and settled in September 2026. Whatever your risk analysis looks like on the day of an incident is what OCR will judge years later.

What the rule actually requires

The requirement sits at 45 CFR 164.308(a)(1)(ii)(A). Every covered entity and business associate must conduct "an accurate and thorough assessment" of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI it holds. It is a required implementation specification, not an addressable one.

It is paired with 164.308(a)(1)(ii)(B), risk management: you must put security measures in place that reduce those risks to a reasonable and appropriate level. A risk analysis with no follow-up plan does not satisfy the rule. That is why nearly every corrective action plan above requires both a new risk analysis and a risk management plan.

OCR's own guidance explains what "accurate and thorough" means in practice. The analysis should cover all ePHI the organization creates, receives, maintains or transmits, wherever it lives. It should identify threats and vulnerabilities, assess current controls, rate likelihood and impact and be documented and updated. NIST SP 800–66 Revision 2 walks through the same process step by step.

The Ambry case also shows how a weak risk analysis tends to travel with other gaps. OCR also cited missing procedures to end access when a workforce member leaves, which maps to 164.308(a)(3)(ii) and missing unique user IDs, which maps to 164.312(a)(2)(i). A good risk analysis is the process that would have surfaced both.

Why small providers get this wrong

From what I see in these cases, the failure is rarely that nobody ever thought about security. It is usually one of four things:

1. The scope was too narrow. The analysis covered the EHR but not email, the fax server, the billing vendor's portal or the laptop the owner takes home. Ambry's breach started in an email account.
2. It was a checklist, not an analysis. A yes or no questionnaire does not rate likelihood and impact for each threat to each system.
3. It was never updated. A risk analysis from three years ago does not reflect the new pharmacy software, the telehealth platform or the staff turnover since.
4. Nothing happened after it. Risks were listed but never assigned an owner, a budget or a deadline under a risk management plan.

There is also a regulatory backdrop worth knowing. HHS proposed major Security Rule amendments in January 2025, but the rule is not final. A recent Clark Hill summary reports that HHS's latest regulatory agenda lists it as a long-term action with a July 2027 target. Do not wait for it. The current rule is fully enforceable and every case above was decided under it.

What to check this week

For a small pharmacy, clinic, nursing home or home health agency:

1. Find your current risk analysis and check its date. If it is more than a year old, or predates a major system change, it needs an update.
2. Compare its scope to reality. List every place ePHI lives: EHR, pharmacy system, email, fax, scanners, phones, cloud storage, backups and each business associate. Anything missing from the analysis is a gap.
3. Look for a risk management plan. Each high or medium risk should have an owner, an action and a target date. If the list stops at "risks identified," the second half of 164.308(a)(1) is missing.
4. Test two controls that keep showing up. Can you show that a departed employee lost access the day they left? Does every user log in with their own account, with no shared logins at the front desk?
5. Use a free starting point if you have nothing. The HHS and ONC Security Risk Assessment Tool and the HHS 405(d) Health Industry Cybersecurity Practices are built for smaller organizations.

The bottom line

No one can promise you will never be phished or hit by ransomware. What you can control is what OCR finds when it asks for your risk analysis. Make sure it is current, complete and followed by action, because that document will speak for you years after the incident.

At Kamili Privacy, we run gap assessments against the HIPAA Security and Privacy Rules and serve as fractional Privacy and Security Officer for US healthcare providers. If you'd like a second set of eyes on your risk analysis, feel free to reach out.