A $4.3 Million Wake-Up Call That Started with a Missing Checkbox
In 2023, Banner Health agreed to a $1.25 million settlement with OCR after investigators found the organization had failed to conduct an enterprise-wide risk analysis. That same year, LA Care Health Plan paid $1.3 million for a similar gap. These weren't small clinics operating on shoestring budgets. They were large, sophisticated organizations — and they still got the annual HIPAA risk assessment wrong.
I've reviewed hundreds of risk assessments over the years. The uncomfortable truth? Most of them wouldn't survive an OCR investigation. They're too vague, too narrow, or too stale to actually protect your organization.
This post walks you through what your annual HIPAA risk assessment actually needs to include, where organizations consistently fall short, and how to build a process that holds up under real scrutiny.
What Is an Annual HIPAA Risk Assessment, Really?
The HIPAA Security Rule at 45 CFR § 164.308(a)(1)(ii)(A) requires every covered entity and business associate to "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information." That's ePHI — every system, every device, every workflow that touches it.
Notice the regulation doesn't say "annual." It says you need to conduct one. But here's the practical reality: OCR expects your risk assessment to be current. If you conducted one three years ago and nothing has changed, maybe you can defend that. But something has changed. New EHR modules. Staff turnover. A move to cloud hosting. A new telehealth platform you bolted on during 2020 and never reassessed.
In my experience, treating the risk assessment as an annual exercise is the minimum defensible standard. Anything less is gambling.
The 6 Mistakes I See in Almost Every Risk Assessment
1. Treating It Like a Checklist
The most common failure is confusing a risk assessment with a compliance checklist. A checklist asks: "Do you have a firewall? Yes or no." A risk assessment asks: "What are the specific threats to ePHI in your environment, how likely are they, and what would the impact be?" These are fundamentally different exercises.
OCR has published detailed guidance on risk analysis that spells this out. If your annual HIPAA risk assessment doesn't identify specific threats, estimate their likelihood, and evaluate your current controls against each one — it's not a risk assessment. It's a survey.
2. Scoping Too Narrowly
I reviewed an assessment last year for a multi-location dermatology practice. Their risk assessment covered the EHR. That's it. Not the imaging systems. Not the patient portal. Not the staff smartphones used to photograph wound progress. Not the third-party billing platform.
Your risk assessment must be enterprise-wide. Every system that creates, receives, maintains, or transmits ePHI falls in scope. Every single one.
3. Ignoring Business Associates
Your cloud hosting provider, your shredding company, your IT managed services vendor — they all handle PHI on your behalf. Your risk assessment needs to account for the risks they introduce. That doesn't mean you assess their environment (though you can ask for their SOC 2 report). It means you assess the risk of entrusting PHI to them and whether your BAA and oversight are adequate.
4. No Risk Ratings
OCR wants to see that you've assigned risk levels. High, medium, low — however you categorize them, every identified risk needs a rating based on likelihood and impact. I've seen assessments that list 40 risks and rate zero of them. That document is essentially useless for decision-making, and OCR will see it the same way.
5. No Remediation Plan
Finding risks is half the job. The other half is documenting what you're going to do about them. Every high and medium risk should have an assigned owner, a target remediation date, and a planned action. OCR settlement agreements consistently cite failures to "implement security measures sufficient to reduce risks and vulnerabilities" — not just failures to identify them.
6. No Documentation Trail
If you didn't document it, it didn't happen. Your completed risk assessment, your remediation plan, your progress updates — all of it needs to be retained for at least six years under HIPAA's documentation requirements. I've worked with organizations that genuinely did solid risk analysis work but couldn't prove it because they kept everything in someone's head or on a whiteboard that got erased.
The $3 Million Question: What Does OCR Actually Look For?
When OCR opens an investigation — usually triggered by a breach report or a complaint — the first document they request is your risk assessment. Not your policies. Not your training records. Your risk assessment.
In the 2018 settlement with Anthem, which paid $16 million, OCR specifically cited the failure to conduct an enterprise-wide risk analysis as a key finding. Fresenius Medical Care paid $3.5 million in 2018 for multiple HIPAA violations, including — you guessed it — insufficient risk analysis across its entities.
Here's what OCR is checking:
- Did you identify all systems containing ePHI?
- Did you identify reasonably anticipated threats to each?
- Did you assess the likelihood and impact of each threat?
- Did you evaluate your current security measures?
- Did you assign risk levels?
- Did you create and act on a remediation plan?
- Is the assessment current?
If any of those answers is "no," you have a gap that could cost you six or seven figures.
How Often Should You Really Do a Risk Assessment?
The short answer: at least annually, and whenever a significant change occurs in your environment.
Significant changes include new technology implementations, mergers or acquisitions, office relocations, major staffing changes in IT or compliance roles, and security incidents — even ones that don't rise to the level of a reportable breach.
The annual cadence gives you a regular rhythm. But don't treat it as a calendar event that happens every January and gets forgotten by February. The best organizations I've worked with embed risk assessment into their operational workflow. They update it quarterly and do a comprehensive review once a year.
Building Your Annual HIPAA Risk Assessment: A Practical Framework
Step 1: Inventory Everything
Start with a complete inventory of systems, devices, and applications that interact with ePHI. Include workstations, mobile devices, servers, cloud platforms, medical devices, fax machines (yes, still), and paper records if they're digitized at any point.
Step 2: Map Data Flows
Trace how ePHI moves through your organization. Where does it enter? Where is it stored? Who accesses it? Where does it go when it leaves? This step alone reveals risks most organizations never considered.
Step 3: Identify Threats and Vulnerabilities
Use HHS's own threat categories as a starting point: natural disasters, human threats (both intentional and unintentional), and environmental threats. Then get specific. Phishing attacks targeting your billing staff. Unencrypted laptops carried by traveling clinicians. A legacy system running Windows Server 2012 that no longer receives security patches.
Step 4: Assess Current Controls
For each threat, document what controls you already have in place. Encryption, access controls, audit logging, workforce training — all of it. Be honest. "We have a policy" is not the same as "we enforce this policy and can demonstrate compliance."
Step 5: Rate and Prioritize
Assign likelihood and impact scores. Multiply them or use a matrix — the method matters less than consistency. Your highest-rated risks get addressed first.
Step 6: Create the Remediation Plan
Document specific actions, responsible parties, timelines, and budgets. This is the document that transforms your risk assessment from an academic exercise into an operational tool.
Training Is the Control You're Probably Underestimating
Every risk assessment I've ever conducted identifies workforce behavior as a top-tier risk. Phishing clicks. Improper PHI disclosures. Lost devices. Weak passwords. These aren't technology problems — they're training problems.
If your annual HIPAA risk assessment identifies human error as a significant threat (and it will), your remediation plan needs to include robust, role-specific training. Not a once-a-year slide deck that people click through in eight minutes. Actual education that changes behavior.
Our HIPAA Fundamentals 2025 course covers exactly the scenarios that show up in real breach investigations — from phishing recognition to proper PHI handling procedures. If your risk assessment keeps flagging workforce issues and your training program hasn't evolved, there's a disconnect that OCR will notice.
You can explore the full range of training options in our course catalog to find programs that align with the specific risks your assessment identifies.
What Happens If You Skip It
Let me be blunt: the annual HIPAA risk assessment is the single most scrutinized compliance requirement in HIPAA enforcement history. More settlements reference risk analysis failures than any other provision. OCR has made it clear — through enforcement actions, guidance documents, and public statements — that this is the foundation of your entire security program.
Skipping it, or doing it poorly, doesn't just create regulatory risk. It creates actual security risk. The risk assessment is how you find the vulnerabilities that lead to breaches. The organizations that skip this step are the ones that end up on the HHS Breach Portal — the so-called "Wall of Shame."
Your Next Move
Pull out your most recent risk assessment. If it's more than 12 months old, that's your first problem. If it reads like a checklist, that's your second. If it has no remediation plan attached, that's your third.
Fix those three things and you'll be ahead of 80% of the covered entities I've assessed. The annual HIPAA risk assessment isn't glamorous work, but it's the work that keeps your organization off OCR's radar — and your patients' data where it belongs.