A small neurology practice paid OCR after ransomware, and the finding centered on its risk analysis, so here is what happened and how to test yours first.
When ransomware hits a small practice, the schedule goes dark and patients wait in the lobby. What owners rarely picture is the second event, when a federal regulator asks what the practice did beforehand to understand its risks. Both events deserve preparation, and the second is the one you can do something about today.
What OCR found
A small neurology practice in New York, which is a HIPAA covered entity, had ransomware encrypt its IT network, affecting about 6,800 people. The HHS Office for Civil Rights (OCR) found that the practice had failed to conduct an accurate and thorough risk analysis of the risks to its electronic protected health information (ePHI).
The practice paid OCR $25,000 and agreed to a two-year corrective action plan that OCR monitors, announced April 25, 2025. OCR called it its 12th ransomware enforcement action and its 8th under the Risk Analysis Initiative. I read those counts as a sign that ransomware and the risk analysis are being looked at together. The attack is what brought the practice into the story, but the finding OCR announced was about the risk analysis, and that is the part I would focus on.
Why size does not settle it
Small practices often tell me they are too small for anyone to notice. This one was small, and the settlement happened anyway. Nothing in this case says every attack ends in an enforcement action. What it does show is that when a small practice came to OCR's attention, the finding was about whether it had understood its risks in writing beforehand. This is an auditor's reading of one settlement, not legal advice.
What I would do first
I would sit down with whoever manages your IT and whoever runs the front office, and ask one question: if our network were encrypted this morning, what could we not do, and what would we need to get going again? Their answers point to three places to check. First, backups: where they are kept, whether they sit apart from the network that would be encrypted, and whether anyone has ever practiced restoring from them. Second, access: who holds administrator rights, and how those accounts are protected. Third, outside providers: which vendors connect to your systems, and who watches that connection.
Then I would compare those answers with the risk analysis on file and write the gaps into it. A practice that admits a weak backup arrangement in its own document, with a plan to fix it, is in a far better position than one with a polished document that does not match how the office runs. Software helps with backups and monitoring, but the written analysis is where your decisions become visible.
When you are ready to test yours, I am happy to talk it through on a call with AssureRidge Cyber.