Article
What OCR announced
The HHS Office for Civil Rights resolved four ransomware-related investigations with settlements totaling $1,165,000. The breaches behind them exposed electronic health information for roughly 427,000 people. The entities were an imaging provider, a multistate women’s health practice, a self-funded employer health plan and a third-party benefits administrator.
The common thread was not the attack itself but what came before it. In all four cases, OCR found that the organization had not completed an accurate and thorough risk analysis. Each agreed to a corrective action plan with two years of federal monitoring. With these settlements, OCR has now closed six investigations with penalties in 2026, collecting $1,278,000.
Several of the underlying incidents date to 2020 and 2021, a reminder that enforcement often arrives years after the breach. OCR has also signaled that its long-running focus on risk analysis now extends to risk management: investigators will ask not only whether risks were identified but whether they were fixed on time.
A parallel warning on covert networks
On April 24, the American Hospital Association pointed members to a federal advisory from CISA (AA26-113A) describing how China-linked actors route activity through networks of compromised devices to stage attacks. John Riggi, the AHA’s national advisor for cybersecurity and risk, said the warning is especially relevant to hospitals, which have already seen exposure to campaigns known as Volt Typhoon and Flax Typhoon.
His recommendations were practical: inventory connected devices and flag those that are unpatched or outdated, revisit policies for remote-work technology, watch more closely for unusual web traffic, and move toward behavior-based defenses.
What leaders should ask now
- Is our risk analysis current and enterprise-wide? It should cover every system that stores or moves patient data, including vendor-hosted platforms and benefit plans.
- Can we show remediation? Boards should see a dated log of identified risks, owners and closure dates, not just the assessment.
- Do we know every connected device? Unmanaged medical and building devices are exactly the kind of equipment adversaries use for covert access.
- Are our business associates held to the same standard? Two of the four settlements involved a health plan and an administrator, not a provider.
Archive entry for May 1, 2026, added Nov. 11, 2026.