OCR's New Security Risk Analysis Initiative Results In Seven Enforcement Actions In First Six Months

In the fall of 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced the first enforcement action in its "Risk Analysis Initiative." Since then, a total of seven enforcement actions have been announced. For many years, the failure to perform an adequate security risk analysis has been a top finding in OCR enforcement actions and a focus of the corrective action plans OCR has entered into with covered entities and business associates. The Risk Analysis Initiative comes as OCR reported a 264% increase in reported large breaches involving ransomware attacks since 2018.¹ OCR has stated that failing to conduct a comprehensive risk assessment significantly increases the risk of ransomware attacks.