OCR Passes 50 Enforcement Actions in 2026 — and Adds Parental Access to Its Target List

When OCR launches an enforcement initiative, the question is always whether it will sustain momentum or quietly fade. The answer in 2026 is clear: OCR is not slowing down. It is adding new targets.

The 50-action milestone

As of January 2026, OCR has settled or imposed civil money penalties in more than 50 HIPAA violation cases under initiatives that include risk analysis and the Right of Access enforcement.

This figure represents two sustained, parallel enforcement programs running simultaneously — and now a third is being added. The volume of enforcement activity in 2026 is not a spike. It reflects an institutionalized enforcement posture that OCR has built over several years and shows no signs of scaling back.

OCR's recent initiatives go beyond merely checking that a risk analysis exists. Instead, OCR now evaluates risk management and mitigation — meaning that how organizations act on those analyses matters. Regulators are increasingly associating weak execution and stagnant risk remediations with lapses that lead to breaches and unauthorized disclosures.

Three active enforcement initiatives — not two

Most compliance professionals are now aware of OCR's two primary enforcement initiatives. What is less understood is that a third has been added in 2026.

Initiative 1 — Risk Analysis Initiative

Now expanded to include risk management, this initiative investigates whether organizations have conducted documented, enterprise-wide risk analyses and — critically — whether they have actually acted on the findings. OCR has made clear it is no longer satisfied with a risk analysis document sitting in a filing cabinet. It wants evidence of remediation.

Initiative 2 — Right of Access Initiative

Launched in 2019, this initiative enforces patients' right to timely, affordable access to their medical records. OCR enforcement continues to emphasize timely patient access and demonstrable documentation of access requests and turnaround times. Practices must track every records request, respond within 30 days, and charge only cost-based fees.

Initiative 3 — Parental Access to Minor Records (new in 2026)

In 2026, regulators are also emphasizing parental access to minor records and updated rights enforcement, making this an area of significant enforcement attention.

This is the newest and least understood of OCR's enforcement priorities. Many covered entities — particularly pediatric practices, adolescent behavioral health providers, and school health clinics — have received conflicting guidance on when parents can and cannot access their minor children's records. OCR is now actively investigating complaints in this area.

Understanding the parental access rules

Under HIPAA, parents are generally the personal representatives of their unemancipated minor children — meaning they have the same rights to access their child's PHI as the child would have themselves.

However there are three narrow exceptions where a covered entity may — and in some cases must — deny parental access:

Exception 1 — Minor consented to care independently: When state or other applicable law permits a minor to consent to a particular healthcare service without parental consent, and the minor consents to that service, the parent is not automatically the personal representative for that service. Common examples include STI treatment, substance use disorder treatment, and mental health services in states where minors have independent consent rights.

Exception 2 — Court-ordered confidentiality: When a court has granted the minor authority to consent or has ordered that the parent not have access.

Exception 3 — Professional judgment: When a licensed healthcare professional determines, in their professional judgment, that providing access to the parent would endanger the minor — for example, in suspected abuse situations.

Outside these three exceptions, denying a parent access to their minor child's records is a HIPAA violation. And OCR is now actively enforcing this.

What all three initiatives have in common

OCR is entering 2026 with an assertive posture focused on provable compliance, timely patient access, and demonstrable security maturity. Expect a continued emphasis on documentation that shows what you implemented, when, and how risks were reduced — not just policies on paper.

The through-line across all three initiatives is documentation and demonstrability. OCR is not asking whether you have good intentions. It is asking whether you can prove what you did, when you did it, and what the outcome was.

For the Risk Analysis Initiative: can you produce a current risk analysis and a risk management plan showing what you did about each finding?

For the Right of Access Initiative: can you produce a log of every records request, when it was received, when it was fulfilled, and what fee was charged?

For the Parental Access Initiative: can you produce your written policies on parental access to minor records, your state law analysis supporting those policies, and documentation of how individual access decisions were made?

The evidence binder concept

Assemble your evidence binder — organized by requirement, date-stamped, and showing who approved each control and when it went live. When OCR asks, you can hand over a ready evidence binder organized by requirement.

This practical concept — a pre-organized collection of compliance documentation ready for OCR review — is worth implementing now rather than scrambling to assemble after an investigation opens. Your evidence binder for each initiative should include:

For Risk Analysis: the risk analysis document, the risk management plan, evidence of remediation actions taken, and dates of updates.

For Right of Access: your access request log, copies of fulfilled requests, fee schedule, and any denial letters with documented justification.

For Parental Access: your written policy on minor records access, your state law analysis, and documentation of how specific access decisions were made when the exceptions applied.