Your HIPAA security risk assessment is due by December. Doing it is not passing it.

Every organization fined under the government's Risk Analysis Initiative had done some kind of security risk assessment. None of it held up. This is what separates a risk analysis that passes from one that becomes evidence against you.

This April, federal regulators announced settlements with four healthcare organizations that had been hit by ransomware: a women's health network, an imaging provider, a benefits administrator, and an employer health plan. Together they paid $1.165 million, and together they had exposed the records of more than 427,000 people.

Here is the detail worth sitting with. The attacks happened in 2020 and 2021. The fines arrived in 2026.

That is how HIPAA enforcement actually works. A breach today becomes a federal investigation that resolves four or five years from now. And when the Office for Civil Rights (OCR) comes asking, the first document it requests is not your firewall config or your antivirus invoices. It is your security risk analysis, the written assessment of where your patient data lives and what threatens it. All four organizations fined in April were cited for the same failure. It was not that they had never done an assessment. It was that what they had could not pass as "accurate and thorough."

OCR's director, Paula Stannard, put the agency's logic plainly this February: organizations "cannot protect electronic protected health information if they haven't identified potential risks and vulnerabilities to that health information." You cannot defend what you never mapped.

The gap between doing the security risk assessment and passing it

OCR does fine organizations after breaches. But read the resolution agreements and a sharper pattern appears. The penalty rarely turns on the breach itself. It turns on what the investigation finds underneath, and what it keeps finding is a risk analysis that exists but does not hold up: outdated, partial, or disconnected from how the organization actually operates.

That is deliberate. In late 2024 OCR launched a dedicated Risk Analysis Initiative to make exactly this point, and it has now completed 13 enforcement actions under it alongside 19 ransomware investigations overall. The targets are not only big systems. February's settlement was a small Illinois addiction treatment center that fell to a phishing email, about $103,000 plus two years of federal monitoring. March's was a dental software vendor.

An assessment that exists but cannot pass does not just fail to protect you. It actively works against you, because a half-done document records your gaps without a plan to close them. Regulators expect findings to flow into a remediation plan with owners, timelines, and budgets. A list of problems with no follow-through is, in an investigator's hands, evidence.

The most common way assessments fail: scope

The federal breach list itself shows where assessments fall short. The most common failure is not a missing document. It is a document that describes a smaller organization than the one that actually exists: the one without the new cloud system, the telehealth platform, the AI scribe, or the billing vendor that now holds half the patient data.

Why this matters in June, specifically

First, about that December deadline. The HIPAA Security Rule itself sets no calendar date; it requires the analysis to be accurate, thorough, and current. The deadline most practices actually feel comes from Medicare: the MIPS Promoting Interoperability program requires the security risk analysis to be conducted within the calendar year, which makes December 31 the effective due date for anyone who bills Medicare. And starting with the 2026 performance year, CMS requires two attestations instead of one: that you conducted the risk analysis, and that you conducted risk management on what it found. The regulators have now written the point of this article into the rulebook. Doing the assessment is no longer enough to attest. Acting on it is part of the requirement.

Most organizations still treat all of this as year-end paperwork, something to rush in December alongside everything else that expires. The data above is the argument against that.

A risk analysis finished on December 20th proves one thing: that on December 20th, you wrote down your problems. It gives you no time to fix any of them before the next renewal, audit, or incident. Done in June, the same document becomes something else entirely. It becomes a finding list with six months of runway to close the gaps, so that what an auditor, insurer, or investigator eventually sees is not a confession but a record of problems found and fixed.

There is a second reason. OCR's guidance is clear that a risk analysis is not a once-a-year ritual in the first place. It must be refreshed when your environment materially changes. Switched EHRs? Moved systems to the cloud? Added telehealth? Signed an AI scribe or a new billing vendor? Each of those changes where your patient data lives, which means the analysis you did last year may no longer describe the organization you are now. If any of those happened since your last assessment, the clock has already restarted, whether or not December feels far away. Our guide to the HIPAA Security Rule covers what a complete analysis must include, and the pending Security Rule update would make the 12-month refresh explicit.

What a defensible HIPAA risk analysis looks like

The difference between doing the SRA and passing it comes down to what the document can prove. A defensible risk analysis covers every system that touches patient data, including vendors. It cites the specific rule each finding maps to. It ranks findings by risk, names an owner for each fix, and shows the dates work started and finished. That is the standard OCR holds organizations to in every settlement above, and it is the standard your cyber insurance carrier and enterprise customers increasingly apply too.

We built our free HIPAA Security Risk Assessment for exactly this. Answer 50 questions drawn from the official HHS assessment tool, about 15 minutes, and two reports land in your inbox the moment you finish: an executive summary with a letter grade your leadership can read, and a detailed findings report where every gap is mapped to the specific HIPAA citation it touches, ranked by risk, with a recommended fix. Not a score for the sake of a score. A finding list with enough runway left in the year to act on it.

Sources: HHS OCR Breach Portal (full archive and under-investigation list, exported June 9, 2026); HHS press release, April 23, 2026; McDonald Hopkins, March 2026; OCR Risk Analysis Initiative resolution agreements, 2024 to 2026. Per-capita rates use 2024 U.S. Census population estimates.