OCR Issues $1.165 Million in Ransomware Penalties — Four Settlements in One Day

In a single day of enforcement activity, the HHS Office for Civil Rights sent an unmistakable message to every HIPAA-regulated entity in the country: if you experience a ransomware attack and you have not conducted a proper risk analysis, you will face financial penalties.

What happened

On April 23, 2026, OCR announced settlements with four different HIPAA-regulated entities following separate ransomware investigations. The combined penalties from these four cases total $1,165,000. With these actions, OCR has resolved six investigations with financial penalties in 2026, resulting in $1,278,000 collected during the year.

Each regulated entity agreed to settle the potential violations through informal resolution and accepted a reduced penalty amount. Each entity also agreed to implement a corrective action plan to address compliance deficiencies identified during the investigations.

The common thread — risk analysis failure

Every single one of the four settlements cited the same underlying violation.

The investigations identified failures related to risk analysis requirements under the HIPAA Security Rule in each of the four enforcement actions.

This is not a coincidence. It reflects OCR's deliberate enforcement strategy. A documented enterprise-wide security risk analysis covering all ePHI is now effectively the first thing OCR looks for after a ransomware incident.

Who was affected — and why it matters for your organization

OCR enforcement under the Risk Analysis Initiative spans across types of HIPAA-regulated entities. Business associates and self-funded employee health plans can be subject to enforcement just like any large health system or commercial health plan.

This is a critical point that many smaller organizations misunderstand. The Risk Analysis Initiative is not targeted at hospitals. It applies to every covered entity and business associate — including small medical practices, billing companies, SaaS vendors, and employer health plans.

Breaches resulting from ransomware attacks are subject to enforcement even if the affected population is relatively small.

What OCR said publicly

OCR Director Paula Stannard emphasized that hacking and ransomware are the most frequent type of large breach reported to OCR, and that proactively implementing the HIPAA Security Rule before a breach or an OCR investigation not only is the law but also is a regulated entity's best opportunity to prevent or mitigate the harmful effects of a successful cyberattack.

The risk management expansion

These four settlements came alongside a significant policy development. In April 2026, OCR released a guidance video on risk management under the HIPAA Security Rule. OCR's Senior Advisor for Cybersecurity Nick Heesters made clear that the agency has formally expanded its enforcement initiative beyond risk analysis to include risk management — what organizations actually do about the risks they identify.

This means the bar has been raised. It is no longer sufficient to have conducted a risk analysis. Organizations must also demonstrate that they acted on their findings — with documented risk management plans, timelines, responsible personnel, and outcomes.

What OCR requires in a proper risk analysis

A complete and accurate risk analysis requires identification of all locations where ePHI is stored. This includes understanding how data enters systems, how it moves within systems, and how it exits systems. An up-to-date asset inventory supports this process by providing a comprehensive record of systems and data locations used within the organization. Without an accurate asset inventory, risk analysis activities may omit systems or data flows, resulting in incomplete identification of vulnerabilities.

What your organization should do now

The pattern from these four settlements — and from OCR's broader enforcement record — makes the required action clear:

1. Conduct or update your risk analysis immediately. If your last risk analysis is more than 12 months old, or if you have added new systems, vendors, or workflows since it was conducted, it needs to be updated. A stale risk analysis is treated by OCR as no risk analysis at all.

2. Document your risk management plan. Identifying risks is not enough. You must document what you are doing about each identified risk, who is responsible, and by when. This documentation is what OCR requests during investigations.

3. Inventory all ePHI locations. Your risk analysis must cover every system, application, device, and data flow that touches ePHI — including cloud services, mobile devices, and third-party vendor systems.

4. Test your incident response plan. Ransomware attacks are the leading cause of large healthcare breaches. Your organization should have a documented, tested response plan before an attack occurs — not be developing one during an active incident.

Key takeaways

Use medcomply.ai's free HIPAA Risk Assessment tool to conduct and document your Security Rule risk analysis — and generate a PDF report that demonstrates compliance if OCR comes asking.