Small Practice, Big Target. OCR Is Coming for Clinics That Skip the Risk Analysis.

Initiative’s 11th action

Top of the World Ranch — Feb 19, 2026

$3M top fine

Solara Medical Supplies — phishing + no risk analysis (2025)

Vision Upright dual figures

Press $5,000 · RA $25,000 (see note)

Feb 2026 latest action

Top of the World Ranch Treatment Center

OCR Has a Program Specifically for Practices Like Yours

In late 2024, the HHS Office for Civil Rights formally launched its Risk Analysis Initiative. The name is deliberate. OCR is not casting a wide net across large health systems — those organizations have compliance teams and legal departments and already fear OCR’s audits. The Initiative targets the long tail: small medical practices, rural clinics, specialty providers, ambulance authorities, imaging centers, behavioral health providers, and business associates that have been deferring their HIPAA risk analysis indefinitely.

The enforcement record that followed tells a consistent story. Between January and August 2025, OCR announced a run of HIPAA settlements, many under the Risk Analysis Initiative. The February 19, 2026 Top of the World Ranch settlement was the Initiative’s 11th enforcement action — signaling that the program continues across administrations. Cash amounts in this wave have included figures as low as the Vision Upright settlement (see dual HHS figures below) up to Solara’s $3 million. By large-organization standards those low-end numbers are not alarming. But the corrective action plans that accompany resolution-agreement settlements (civil money penalties such as Warby Parker’s do not include a CAP — see table) are a different matter. A CAP typically requires two to three years of OCR oversight, documented policy revisions, staff training records, and periodic reporting. For a three-physician practice or a single-location clinic, that overhead is close to existential.

What makes every one of these enforcement actions preventable is the finding that appears across these actions: the organization had not conducted an accurate and thorough risk analysis as required by 45 C.F.R. § 164.308(a)(1)(ii)(A). A HIPAA risk analysis has been a mandatory requirement since 2003. Twenty-plus years in, OCR is still finding practices that have not met that obligation.

The Risk Analysis Initiative Is Active Now: OCR launched this enforcement program with explicit intent to reach small and medium-sized covered entities. If your practice has not conducted a documented HIPAA risk analysis, you are in scope for this program. The question is not whether OCR gets to you eventually — it is whether you correct the gap before they do.

Twelve 2025/2026 Cases That Show the Pattern

The following enforcement actions are drawn from HHS press releases and published resolution agreements during the Risk Analysis Initiative’s 2025 and 2026 enforcement cycles. They share a structural similarity that is not coincidental — in every case, OCR’s investigation concluded that the organization had failed to conduct an accurate and thorough risk analysis as required by 45 CFR 164.308(a)(1)(ii)(A).

Organization	Type	Patients	Fine	Root Cause
Solara Medical Supplies	Medical device supplier	114,000	$3,000,000	Phishing breach; no risk analysis; delayed breach notification
Warby Parker	Eyewear retailer / HBNR entity	200,000	$1,500,000 (CMP)	Credential stuffing; no risk analysis; weak access controls — civil money penalty (no CAP), not a resolution-agreement settlement
Heritage Valley Health System	Regional health system	Not disclosed	$950,000	NotPetya malware via business associate; insufficient risk analysis
PIH Health	Health system	Not disclosed	$600,000	Phishing breach; inadequate security risk analysis
Northeast Radiology	Specialty practice	Not disclosed	$350,000	PACS server exposure; missing risk analysis
USR Consulting	Business associate	2,900	$337,750	Unauthorized database access; ePHI deletion
Syracuse ASC	Ambulatory surgery center	24,891	$250,000	Ransomware; insufficient risk analysis
Health Fitness Corporation	Wellness program company	4,300	$227,816	”Never ran a thorough risk analysis”; inadequate ePHI protections
Behavioral Health Solution of Deer Oaks	Behavioral health provider	Not disclosed	$225,000	Inadequate risk analysis; weak ePHI protections
Vision Upright MRI (California)	Imaging center	21,778	Press: $5,000 · RA Resolution Amount: $25,000 (see note)	Unsecured PACS server; no risk analysis; missed 60-day breach notification
Guam Memorial Hospital Authority	Public hospital	Not disclosed	$25,000	Ransomware; unauthorized access by former employees
Top of the World Ranch Treatment Center (Illinois)	Substance use disorder provider	1,980	$103,000	Phishing email compromise; no risk analysis — Feb 19 2026 settlement

Read the table again and look at the fine column. Vision Upright MRI shows dual HHS figures (press $5,000 / RA $25,000). Guam Memorial Hospital paid $25,000. Health Fitness Corporation paid $227,816 for a breach involving 4,300 individuals. These are not numbers that bankrupt an organization. They are numbers that a practice manager might look at and think: we could handle that.

That framing is wrong. The fine is not the cost. The corrective action plan is the cost. Solara paid $3 million and gets a CAP in the same structural shape as Vision Upright. The CAP is the great equalizer in OCR enforcement.

What a Corrective Action Plan Actually Requires

OCR resolution-agreement settlements under the Risk Analysis Initiative include a corrective action plan; civil money penalties (such as Warby Parker’s) do not. The CAP is not a one-time checklist. It is a multi-year compliance program conducted under OCR supervision. A typical CAP requires the covered entity to:

• Conduct a comprehensive, organization-wide risk analysis within 60 to 90 days of the agreement effective date
• Develop and implement a risk management plan addressing every identified vulnerability
• Revise HIPAA policies and procedures and have them reviewed by OCR
• Train all workforce members with access to ePHI on the revised policies
• Submit annual reports to OCR for the duration of the agreement (typically two to three years)
• Notify OCR within 30 days of any workforce member who does not comply with the plan
• Retain OCR’s right to investigate any subsequent compliance failures during the oversight period

For a small practice, this is a significant administrative burden on top of the cost of whatever remediation the risk analysis identifies. At the same time the CAP is running, the practice is also managing whatever breach notification and recovery work the underlying incident required—often the larger operational cost, before OCR’s fine is even in view.

The fine is the headline. The corrective action plan is the sentence. A two-year CAP on a three-physician practice consumes the equivalent of a part-time staff member just in documentation and reporting overhead.

Solara Medical Supplies: $3 Million, 114,000 Patients, One Missed Risk Analysis

Solara Medical Supplies, a national medical device and supply distributor, paid $3 million in 2025 to settle OCR’s investigation into a phishing-driven breach that compromised the protected health information of approximately 114,000 individuals. The incident began with credential compromise through a phishing email, escalated into unauthorized access to employee email accounts containing ePHI, and concluded with a breach notification that OCR determined did not meet HIPAA’s 60-day timeline.

The finding that drove the $3 million figure was not the phishing attack itself. It was the absence of a compliant risk analysis that would have identified email-based phishing as a likely attack vector, triggered multi-factor authentication across email accounts, and established detection controls for anomalous mailbox access. Solara’s size and resources did not protect it. Its failure to do the analysis did.

The $3 million fine is the ceiling of 2025 Risk Analysis Initiative enforcement. It is also a reference point for smaller organizations: if a national supplier with presumed enterprise resources paid $3 million for a risk analysis failure, a small practice should not assume OCR will treat the same failure as less significant when the ePHI volume is smaller. The enforcement calculus is proportional to ability to pay, but the underlying violation is treated identically.

Health Fitness Corporation: “Never Ran a Thorough Risk Analysis”

Health Fitness Corporation, a wellness program operator working with employers and covered entities, settled with OCR in 2025 for $227,816. The breach affected approximately 4,300 individuals. OCR’s finding, in language that appears verbatim in the press release: the organization had “never ran a thorough risk analysis” of the potential risks and vulnerabilities to the ePHI it created, received, maintained, or transmitted.

That phrasing is worth reading twice. OCR’s published finding language centers on the absence of an accurate and thorough risk analysis — not a paperwork niggle about an outdated spreadsheet. Health Fitness Corporation is a business services organization handling health data in the course of wellness programming — exactly the kind of ancillary entity that often convinces itself the Security Rule is the problem of the covered entity it serves. It is not. Business associates are directly liable under the 2013 Omnibus Rule. The Initiative has reached BAs as well as covered entities — see USR Consulting and Health Fitness Corporation in the table above — so a BA that skips its own risk analysis is not insulated by its covered-entity clients’ paperwork.

$227,816 for 4,300 individuals works out to roughly $53 per affected record. That is before the CAP, before the breach notification costs, before the remediation, before the legal defense, and before the reputational impact of appearing on OCR’s public enforcement database. At that per-record rate, any small practice doing the arithmetic should conclude that a risk analysis costing a few thousand dollars is the rational investment.

Syracuse ASC: 24,891 Patients, Ransomware, $250,000

Syracuse Ambulatory Surgery Center settled with OCR in 2025 for $250,000 after a ransomware attack compromised the ePHI of 24,891 patients. Ambulatory surgery centers operate at the exact size and profile the Risk Analysis Initiative targets: large enough to carry meaningful PHI volume, small enough to have no dedicated security team, often reliant on one external IT vendor for day-to-day support. The Syracuse ASC case is instructive precisely because it fits that pattern without any of the aggravating factors that drive higher fines.

The OCR finding was the standard one: the organization had not conducted a compliant risk analysis, had not implemented risk management controls that would have mitigated the ransomware impact, and had not documented the kind of access monitoring that would have enabled earlier detection. The $250,000 fine reflects the scale of the PHI exposure, but the corrective action plan is what will shape the next two to three years of the organization’s compliance posture.

For a single-site ambulatory surgery center, a 25,000-patient ransomware breach is close to existential — not because of the fine, but because of the operational disruption, class action risk, and insurance market consequences. Cyber insurance carriers have tightened coverage terms for healthcare practices that cannot demonstrate a current risk analysis. Syracuse ASC’s settlement is the kind of case that insurers now cite in underwriting decisions.

Vision Upright MRI: Dual HHS Figures (and Why the CAP Still Dominates)

Vision Upright MRI, a small California imaging provider, settled with OCR over an unsecured PACS server that exposed medical images of 21,778 individuals. OCR’s press release states the provider “paid $5,000” (HHS press, May 15, 2025). The Resolution Agreement on the same matter states a Resolution Amount of $25,000 (RA/CAP). Both documents are published by HHS; this post reports both rather than choosing one. The CAP is a two-year monitored corrective action plan. The finding: Vision Upright had never conducted a HIPAA risk analysis, and it missed the 60-day breach-notification deadline.

Whether the cash amount is five thousand or twenty-five thousand, the corrective action plan requirements are structurally the same shape as those imposed on Solara Medical Supplies, which paid $3 million. The fine scales with OCR’s assessment of culpability and ability to pay. For resolution-agreement settlements, the CAP does not scale with the cash amount the way the fine does. Warby Parker’s CMP is the exception in this table: penalty without a monitored CAP. Guam Memorial Hospital Authority’s $25,000 settlement is another low-end cash example in the same Initiative wave.

Top of the World Ranch Treatment Center: February 2026 — The Initiative Continues

After a six-month pause in announced settlements following the August 2025 wave, OCR resumed Risk Analysis Initiative enforcement on February 19, 2026, with a settlement against Top of the World Ranch Treatment Center (TWRTC), an Illinois substance use disorder provider. Per the HHS OCR press release that day, TWRTC paid $103,000 and agreed to a two-year monitored corrective action plan. The underlying incident was a 2023 phishing compromise of a workforce email account; TWRTC reported that ePHI for 1,980 patients was affected.

The OCR finding was the standard one under the Initiative: TWRTC had failed to conduct an accurate and thorough risk analysis. The February 2026 settlement matters for both the disclosed amount and what it signals. The Initiative survived the administration transition, the enforcement pipeline is active again, and OCR is continuing to prioritize risk analysis failures at small and specialty providers — including substance use disorder treatment, a category of ePHI subject to additional 42 CFR Part 2 protections that make OCR scrutiny more, not less, likely.

If your practice assumed the Initiative was going to be deprioritized in 2026, that assumption is wrong. The small-practice enforcement pipeline is the pipeline.

Business Associates Are In Scope, Always: The Initiative has reached business associates as well as covered entities — including Solara Medical Supplies, USR Consulting, and Health Fitness Corporation. If your organization handles ePHI on behalf of covered entities, OCR treats you as directly liable. Your covered-entity clients’ BAA compliance language does not substitute for your own risk analysis.

The Risk Analysis Is Not Optional and Never Was

The HIPAA Security Rule at 45 CFR 164.308(a)(1)(ii)(A) requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. This has been the law since the Security Rule took effect in April 2003.

A risk analysis is not a one-time event. It must be reviewed and updated periodically and in response to environmental or operational changes. A practice that conducted a risk analysis in 2010 and never updated it does not have a compliant risk analysis. A practice that documents its risk analysis in a spreadsheet, identifies findings, and develops a risk management plan to address them is closer to compliance than it might think — the methodology does not need to be elaborate. It needs to be documented, thorough, and current.

OCR published guidance in 2012 that describes what a compliant risk analysis looks like. The guidance is still current. It requires scope definition, data flow mapping, threat and vulnerability identification, likelihood and impact assessment, and a risk level determination for each finding. None of this requires expensive software. It requires time, documentation, and commitment.

What Small Practices Need to Do Before OCR Calls

The Risk Analysis Initiative is active and its enforcement record is growing. The practices and vendors that have been caught have one thing in common: they waited. The ones that do not appear in OCR press releases also have one thing in common: they did not.

Immediate Priority Actions

• Determine whether your organization has a documented, current HIPAA risk analysis — if you cannot produce it, you do not have one
• If no risk analysis exists, commission one now — before OCR audits your organization or a breach forces the issue
• Scope the risk analysis to include all systems, locations, and workflows that create, receive, maintain, or transmit ePHI
• Include your business associates in the scope of your review — audit their BAAs and request evidence of their own risk analyses
• If you use a PACS, EHR, or any internet-connected medical device, verify it is not publicly accessible without authentication — the Vision Upright MRI enforcement pattern is still active
• Enforce multi-factor authentication on every account with access to ePHI, including email — phishing-driven email compromise was the root cause in both the 2025 Solara Medical Supplies ($3M) and 2026 Top of the World Ranch settlements
• Review your incident detection capabilities — if a ransomware attack could run for several days before you noticed, that is a CAP finding waiting to happen

Risk Management Plan

• Document the findings from your risk analysis and assign a risk level (high, medium, low) to each
• Develop a written risk management plan that describes how each high and medium finding will be remediated and by when
• Assign ownership for each finding to a specific individual, not a department
• Review and update the plan at least annually and after any significant operational change — new EHR, new vendor, new office location, new telehealth capability
• Keep records of the review dates, findings, and remediation status — this documentation is what a CAP will require you to produce

The Calculus OCR Is Running

OCR’s Risk Analysis Initiative is not a surprise audit program hunting for minor technical violations. It is a targeted effort to reach the segment of the covered entity population that has deferred basic HIPAA compliance for years on the assumption that enforcement would not reach them. The Initiative’s design — modest fines, rigorous CAPs — is calibrated to make enforcement economically viable against small organizations while still imposing a real compliance burden.

The pattern across every case in this record is identical: ransomware hits, or a server is found exposed, or a breach notification triggers an OCR complaint. OCR opens an investigation. The investigation finds no risk analysis. The settlement follows. At no point in that sequence does the organization have an opportunity to retroactively conduct the risk analysis they skipped. By the time OCR is involved, the only question is what the resolution agreement looks like.

The practices that are not in this record conducted a risk analysis, found the gaps, and fixed them before the ransomware hit or before the server was found exposed. That is the entirety of the difference between a practice that appears in an HHS press release and one that does not.

Security Medic Can Run Your HIPAA Risk Analysis

Security Medic Consulting delivers HIPAA risk analyses for small practices, clinics, telehealth providers, and business associates. We scope the assessment, document the findings, develop the risk management plan, and give you the deliverables OCR requires — before they ask for them. If you are not sure where you stand, that is the right time to find out.

Schedule a Risk Analysis

Sources and References

1. U.S. Department of Health and Human Services, Office for Civil Rights. (2026, February 19). HHS’ Office for Civil Rights Settles HIPAA Security Rule Investigation with Top of the World Ranch Treatment Center. HHS.gov press release ($103,000). hhs.gov
2. U.S. Department of Health and Human Services, Office for Civil Rights. Resolution Agreement with Vision Upright MRI (Resolution Amount $25,000). hhs.gov
3. U.S. Department of Health and Human Services, Office for Civil Rights. HHS Office for Civil Rights Settles HIPAA Cybersecurity Investigation with Vision Upright MRI (press release states $5,000; see Resolution Agreement for $25,000). hhs.gov
4. U.S. Department of Health and Human Services, Office for Civil Rights. (2025). Resolution Agreements and Civil Monetary Penalties. HHS.gov enforcement index. hhs.gov
5. McDonald Hopkins. (2026). OCR announces 11th and 12th Risk Analysis Initiative enforcement actions. mcdonaldhopkins.com
6. Nixon Peabody LLP. (2025, June 12). 2025 HIPAA enforcement tally rises following three new settlements. nixonpeabody.com
7. Ogletree Deakins. (2025). 2025 Enforcement Trends: Risk Analysis Failures at the Center of HHS’s Multimillion-Dollar HIPAA Penalties. ogletree.com
8. Feldesman Tucker Leifer Fidell LLP. (2025). OCR’s New Security Risk Analysis Initiative Results in Seven Enforcement Actions in First Six Months. feldesman.com
9. Sequoia Consulting Group. (2025, July). HIPAA Enforcement in 2025: Increased Focus on Security Risk Analysis. sequoia.com
10. Wilson Elser. (2025). HHS-OCR Risk Analysis Enforcement Initiative Continues Under New Administration. wilsonelser.com
11. McCarter & English, LLP. (2025). Season of Enforcement: OCR Announces Its Sixth Enforcement Action of 2025. mccarter.com
12. U.S. Department of Health and Human Services, Office for Civil Rights. (2012). Guidance on Risk Analysis Requirements under the HIPAA Security Rule. hhs.gov
13. 45 C.F.R. § 164.308(a)(1)(ii)(A) — HIPAA Security Rule, Administrative Safeguards: Risk Analysis.