Recent OCR Settlements: What HHS Actually Penalizes (2025)

OCR settlement patterns in 2024-2025 show three dominant deficiencies: missing or inadequate Security Risk Analysis under 45 CFR § 164.308(a)(1)(ii)(A)(1)(ii)(A)), late or absent breach notification under 45 CFR §§ 164.404–164.408, and patient access denials under 45 CFR § 164.524. Recent Resolution Agreements range from $15,000 small-practice access cases to multi-million-dollar ransomware settlements.

The Risk Analysis Initiative

In October 2024, OCR announced the Risk Analysis Initiative, prioritizing investigations against entities lacking an accurate and thorough Security Risk Analysis. The Security Rule has required a risk analysis since the rule's 2003 effective date, and OCR has identified its absence as the single most-cited deficiency in resolution agreements for over a decade.

The Initiative has produced a string of published settlements. Published 2024-2025 Risk Analysis Initiative resolutions on the OCR Enforcement Highlights page include settlements ranging from approximately $150,000 to over $1.5 million, paired with three-year corrective action plans that require:

• A current, written risk analysis per 45 CFR § 164.308(a)(1)(ii)(A)(1)(ii)(A))
• A risk management plan per 45 CFR § 164.308(a)(1)(ii)(B)(1)(ii)(B))
• Updated policies and procedures
• Workforce training per 45 CFR § 164.308(a)(5)(5))
• Quarterly status reports to OCR
• Final implementation report at the end of the CAP period

The practical pattern: a breach is reported, OCR opens an investigation under 45 CFR § 160.306, the investigation surfaces the absence of a risk analysis, the settlement names the missing risk analysis as a primary finding. The breach is the surface; the missing risk analysis is the depth charge.

The Right of Access Initiative

OCR's Right of Access Initiative, ongoing since 2019, has produced more than 50 published settlements through 2025. The full list of Right of Access Initiative resolutions sits on the OCR Enforcement Highlights page. Most settlements are $15,000-$80,000 with two-year corrective action plans.

The pattern under 45 CFR § 164.524 is consistent: a patient or personal representative requests a copy of records, the practice does not provide them within 30 calendar days (or fails to invoke the one-time 30-day extension properly), the patient files an OCR complaint, OCR investigates, the practice settles.

What the published settlements specifically penalize:

• Failure to provide records within 30 days under 45 CFR § 164.524(b)(2)(2))
• Failure to provide records in the form and format requested when readily producible under 45 CFR § 164.524(c)(2)(2))
• Charging more than the Limited Fees permitted under the access guidance
• Failure to provide records to personal representatives properly designated
• Failure to act on a patient's request to direct records to a third party under 45 CFR § 164.524(c)(3)(3))

This is the highest-volume OCR enforcement pattern. A small-practice front desk that does not produce records inside 30 days is the most likely complaint path.

Ransomware and the breach-notification chain

Ransomware settlements show the compound-failure pattern. The HHS ransomware fact sheet treats the presence of ransomware on a system containing ePHI as a presumptive breach unless the four-factor analysis at 45 CFR § 164.402 rebuts the presumption.

Recent multi-million-dollar ransomware settlements show a recurring sequence:

1. A ransomware event encrypts ePHI
2. The covered entity either underreports affected individuals or delays the breach notification beyond 45 CFR § 164.404(b))'s 60-day clock
3. OCR opens an investigation following the HHS Portal submission
4. The investigation finds (a) no current risk analysis, (b) no contingency plan exercised under 45 CFR § 164.308(a)(7)(7)), (c) inadequate audit controls under 45 CFR § 164.312(b)), (d) inadequate access controls under 45 CFR § 164.312(a)), and (e) late notification

The settlement penalizes the compound failure, not just the ransomware. The corrective action plans run three years and require external assessor verification at multiple checkpoints.

What recent corrective action plans actually require

A read of any recent OCR CAP on the Enforcement Highlights page shows a common skeleton:

• Submit a current risk analysis within 90-120 days of the resolution agreement
• Submit a risk management plan addressing every identified risk
• Update and submit policies and procedures across the Security Rule and Privacy Rule
• Retrain the workforce within a defined timeline and submit training records
• Submit annual or quarterly status reports for the CAP period
• Engage an independent assessor for some matters
• Submit a final implementation report at CAP end

Compliance with the CAP is monitored by OCR. Failure to comply with the CAP can produce a further finding under 45 CFR § 160.408 and additional civil monetary penalties.

The civil monetary penalty matrix

Statutory tiers under 45 CFR § 160.404, as adjusted by the annual civil penalty inflation adjustment, set the maximum civil monetary penalty per violation by culpability tier:

• No knowledge — lowest tier
• Reasonable cause — middle tier
• Willful neglect, corrected within 30 days — higher tier
• Willful neglect, not timely corrected — highest tier

Tiers apply per violation, with annual caps per identical violation. OCR's settlement amounts are generally well below the statutory maximums; the maximums are anchor points in negotiation.

What OCR cites most often in resolution agreements

Across recent published resolution agreements, the deficiencies that recur:

• Absent or stale Security Risk Analysis under 45 CFR § 164.308(a)(1)(ii)(A)(1)(ii)(A))
• Absent or inadequate risk management process under 45 CFR § 164.308(a)(1)(ii)(B)(1)(ii)(B))
• No information system activity review under 45 CFR § 164.308(a)(1)(ii)(D)(1)(ii)(D))
• No contingency plan exercised under 45 CFR § 164.308(a)(7)(7))
• Encryption decision not documented under 45 CFR § 164.312(a)(2)(iv)(2)(iv))
• No or inadequate audit controls under 45 CFR § 164.312(b))
• Missing or stale BAAs with vendors handling ePHI under 45 CFR § 164.502(e))
• Late or absent breach notification under 45 CFR §§ 164.404–164.408
• Right of access denials under 45 CFR § 164.524
• Inadequate workforce training under 45 CFR § 164.308(a)(5)(5))

A practice that addresses these ten controls — with documented evidence — is positioned to navigate an OCR inquiry on far better terms than one that does not.

State AG parallel enforcement

Under the HITECH Act state enforcement authority at 42 USC § 1320d-5(d) (added by HITECH § 13410(e)), state attorneys general can bring HIPAA civil actions on behalf of state residents. State AGs have brought enforcement actions in parallel with OCR.

State-specific overlays that often pair with HIPAA enforcement:

• California — CMIA (Civil Code §§ 56–56.37) and the California AG's consumer protection authority
• New York — SHIELD Act (General Business Law § 899-aa, § 899-bb) and the AG's data-security authority
• Texas — HB 300 (Health and Safety Code Chapter 181) and Texas AG enforcement under Business and Commerce Code Chapter 521
• Massachusetts — 201 CMR 17.00 and Mass. AG enforcement under M.G.L. c. 93A and c. 93H

State AG parallel cases can run alongside OCR investigations or follow them. The cumulative settlement exposure is the sum of federal and state.

How to learn from the published record

OCR posts every resolution agreement at HHS HIPAA Enforcement Highlights. Read recent settlements in the practice's specialty. The pattern of cited deficiencies is the practical roadmap for what to put in place before an incident — and what to fix immediately after one.

The HHS Breach Portal shows every 500+ breach report. Reading the entries for the practice's geography and specialty is a calibration exercise on what threats are actually hitting peers.

How d3rx fits

d3rx maintains the program elements OCR cites most often inside the compliance binder: risk analysis workflow, risk management tracker, BAA log, training log, breach incident workflow, right-of-access tracker, and policies and procedures. The binder is a source-grounded administrative aid. It does not represent the practice in any OCR investigation, does not provide legal advice, and does not replace counsel. See audit defense for broader response support and the compliance binder overview for binder structure.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.