Rehab Center Pays $103,000 After Phishing Attack: OCR's 11th Risk Analysis Enforcement Action

The February 2026 settlement with Top of the World Ranch Treatment Center makes two things clear: OCR does not size-grade its enforcement, and a phishing attack without a completed risk analysis is an almost automatic enforcement action.

What happened

Top of the World Ranch Treatment Center, a rehabilitation center in Illinois, agreed to a $103,000 and 2-year corrective action plan settlement following a security breach. In March 2023, an employee's email account was compromised in a phishing attack, exposing fewer than 2,000 records. The settlement is OCR's 11th enforcement action under the Risk Analysis Initiative.

The facility is a substance use disorder treatment center handling some of the most sensitive PHI in existence. The settlement was announced days after OCR officially enacted the Part 2 changes to the Notice of Privacy Practices. As of February 16, 2026, all covered entities must update their Notices of Privacy Practices to include special provisions regarding the handling of Substance Use Disorder PHI.

The root cause: no risk analysis

The facility had never completed a HIPAA Security Rule risk analysis before the breach occurred. Without that analysis, the organization could not have known what its vulnerabilities were and therefore could not have implemented controls to address them.

This is the pattern OCR has documented across 11 consecutive Risk Analysis Initiative enforcement actions: a security incident occurs, OCR investigates, and the investigation reveals the organization had never completed a formal risk analysis. The requirement is not complex in concept — organizations must document all ePHI they hold, identify threats and vulnerabilities, assess existing controls, and determine the likelihood and impact of each risk. What makes it challenging is the discipline to do it thoroughly and keep it current.

Why phishing attacks and risk analyses are connected

Phishing is the leading cause of healthcare data breaches, with approximately 80% of all reported large breaches attributable to hacking. A comprehensive risk analysis would have identified employee email as a potential attack surface. A risk management plan addressing that finding would have prompted implementation of controls — multi-factor authentication, email filtering, phishing awareness training — that could have prevented or limited the impact of the attack.

The behavioral health and SUD enforcement signal

The TWRTC settlement is OCR's first Risk Analysis Initiative enforcement action against a substance use disorder treatment facility. Behavioral health providers and addiction treatment centers often operate with limited administrative infrastructure and may assume their smaller size reduces enforcement exposure. The TWRTC settlement is a direct signal that it does not.

SUD providers now face enforcement exposure on multiple fronts simultaneously:

• HIPAA Security Rule enforcement for risk analysis failures
• HIPAA Privacy Rule and Breach Notification Rule enforcement
• Part 2 enforcement for SUD-specific confidentiality violations
• Updated NPP requirements effective February 16, 2026

What the corrective action plan requires

The two-year CAP TWRTC agreed to reflects OCR's standard remediation framework for Risk Analysis Initiative cases:

Complete a comprehensive enterprise-wide risk analysis covering all ePHI systems. Develop a risk management plan with specific remediation actions and timelines. Update security policies and procedures. Provide workforce training. Submit periodic compliance reports to OCR.

OCR monitors CAP compliance for the full duration. Failures to comply can result in additional enforcement action.

The message to small and specialized providers

The TWRTC breach exposed fewer than 2,000 records. The penalty is $103,000 plus two years of OCR monitoring. The disproportion between breach size and enforcement consequence exists precisely because the underlying violation — never conducting a risk analysis — represents a complete failure of the organization's foundational compliance obligation.

If you have a breach and no risk analysis, the first thing OCR will ask for is documentation of your risk analysis. If you cannot produce it, enforcement action follows regardless of the number of records involved.