For years, HIPAA enforcement was widely regarded as a concern reserved for hospital systems and national insurers, the kind of problem a small practice could observe from a safe distance. That assumption has been thoroughly dismantled this year. Between January and June of 2026, the Office for Civil Rights at the U.S. Department of Health and Human Services announced seven settlements for alleged HIPAA violations, and every one of those seven included a financial penalty tied to a failure to conduct an adequate risk analysis. Several of the penalized organizations were small provider groups, and in one case a fine of $103,000 was levied against a single treatment center. The message being sent is difficult to misread: the risk analysis is no longer paperwork that can be filed away and forgotten, and the size of the organization offers no shelter.
The broader breach landscape explains why regulators have sharpened their focus. According to the H1 2026 Healthcare Data Breach Report, 397 data breaches affecting 500 or more individuals were reported to OCR during the first half of the year, exposing the protected health information of roughly 33.8 million people. Hacking and IT incidents rose for the third consecutive year even as other breach categories declined, and network servers and email remain the most common places where records are compromised. Having spent a good part of my career sitting across the table from practice administrators who assumed their two-location clinic was too small to attract attention, I can say with some confidence that the attackers do not share that assumption. Patient records are valued precisely because they cannot easily be replaced, and the extortion economy built around them has only matured.
Why the Risk Analysis Draws Enforcement Attention
The risk analysis enforcement initiative was formally launched in October 2024 in response to widespread noncompliance with that single provision of the Security Rule, and it has since produced fourteen financial penalties. This year the initiative was expanded to include risk management, which means an organization must now demonstrate not only that a compliant risk analysis was conducted but also that the risks identified were actually reduced to a low and acceptable level within a reasonable timeframe. In our own reviews of healthcare environments, the pattern is remarkably consistent: a risk analysis was performed once, perhaps when an electronic health record system was first adopted, signed by someone who has since left the organization, and never revisited as new devices, vendors, and remote access paths were added. A document like that satisfies no one at OCR, and it satisfies no one during an actual incident.
A defensible risk analysis is not a template that gets filled out in an afternoon. Assets must be inventoried, threats and vulnerabilities must be evaluated for likelihood and impact, and the findings must be connected to a documented plan of remediation that can be evidenced over time. When the analysis is treated as a living process rather than a compliance artifact, the security improvements regulators are looking for tend to follow naturally, because the practice finally has a prioritized list of what genuinely needs attention.
What Small Practices Should Be Doing Now
The most practical starting point is an honest assessment of the current state. Multifactor authentication should be in place across email and remote access, backups should be tested rather than merely configured, and patching should be verified rather than assumed. Decisions about when a healthcare organization should bring in outside IT support become easier once the internal gaps are laid out clearly, and the cost of managed IT for a medical practice is frequently smaller than a single OCR settlement.
It should also be noted that a proposed update to the HIPAA Security Rule remains pending, and while its final form and timing are uncertain, the direction of enforcement is already clear. The practices that will be positioned well, regardless of what the final rule requires, are those that can produce current documentation, evidence of remediation, and a partner accountable for the day-to-day security of the environment. In our experience, the peace of mind that comes from that readiness is worth every bit as much as the compliance itself.