OCR settled with a wellness-plan company over a risk analysis it had failed to do properly, and here is how to test whether yours would hold up.
Many practices have a risk analysis in a folder somewhere, produced once by a consultant or a template and rarely opened since. The better question is whether it would show an outsider that you looked honestly at where patient information lives and what could go wrong with it.
What OCR found
On March 21, 2025, the HHS Office for Civil Rights (OCR) announced that Health Fitness Corporation, an Illinois wellness-plan company acting as a HIPAA business associate, paid $227,816 and agreed to a corrective action plan monitored for two years. OCR found the company had failed to conduct an accurate and thorough risk analysis until January 19, 2024.
Behind that finding was a software misconfiguration that left electronic protected health information (ePHI) searchable by web crawlers starting around August 2015. The company found the exposure on June 27, 2018, and first estimated that about 4,304 people were affected, though it later said the figure may be lower. OCR called this the fifth enforcement action under its Risk Analysis Initiative, which tells me the regulator has a named effort built around exactly this gap.
Why a setting becomes a risk analysis problem
A wrong setting can happen anywhere software runs, and good software supports compliance. OCR's finding, though, was about the missing analysis: the written exercise that asks where ePHI sits, what can reach it, and what happens when something is configured badly.
A risk analysis is not a scan, and it is not a product you buy. It is a written examination, done by people who understand how your practice really works, of the risks to patient information, followed by a decision about what to do with each one. The tools feed into it, but the practice and its people are what make it real. In twenty years of auditing, I have seen plenty of practices that hold a risk analysis in name only, and that is the version that does not survive a real conversation with an auditor. This is an auditor's reading of one settlement, not legal advice.
What I would do first
First, I check scope, because that is where analyses most often fall short. It should cover every place patient information lives, including cloud tools, scanners, shared mailboxes and systems a vendor manages for you. The less obvious places, such as a cloud tool someone signed up for to save time, are where trouble tends to start. Second, I check that it is written, dated and updated since your last change in software, location or vendors. Third, I compare the document with what people actually do, since a tightly controlled policy means little if the front desk shares a login. Finally, I look for decisions: a short list of risks, each with an owner and a next step, instead of a list of findings that stops there.
If you would like a second set of eyes on yours, you can book a call with AssureRidge Cyber on my calendar.