Read the four cases together and a pattern is hard to miss. Different organizations, different attacks, different years, and in every single one, OCR's investigation landed on the same finding: no accurate and thorough risk analysis. Not weak encryption, not a missing firewall. The organization had never properly written down where its electronic patient information lived, how it moved, and what could realistically go wrong with it. OCR Director Paula M. Stannard framed it directly in the announcement: implementing the Security Rule before a breach or an investigation is a regulated entity's best opportunity to prevent or reduce the damage from a successful attack.
Be clear-eyed about who these four were. A multi-state women's health network, a medical imaging provider, a third-party benefits administrator, and a self-funded employee health plan: none of them a 1–10 person clinic. What carries across to a small practice is not the dollar figure, it is the finding. The risk analysis obligation does not scale down or switch off below a certain headcount. A solo dental office with a cloud practice-management system and a front-desk PC is expected to have done the same basic exercise as an organization a hundred times its size, and OCR has reached this same conclusion in 13 completed investigations under its Risk Analysis Initiative.
The useful thing about a small practice is that the exercise is genuinely small. For most clinics under 20 people, the honest answer to "where does patient information live?" is four or five places: the practice management or record system, email, the billing or clearinghouse tool, whatever is on the front-desk and clinical workstations, and any backup. Writing that list down, noting what could go wrong with each, and recording what you decided to do about it is the substance of a risk analysis. One of these four cases traced back to a phishing email that gave an attacker a foothold more than a year before the ransomware was deployed, the kind of exposure a written walk-through of your own systems is designed to surface early.
What to check in your practice
- Write down every place electronic patient information lives in your practice: record system, email, billing and clearinghouse tools, workstations, phones, and backups. OCR's first recommended step is knowing how that information enters, moves through, and leaves your systems.
- For each one, note what could realistically go wrong (stolen password, phishing email, lost laptop, ransomware on a server) and what you have in place today.
- Confirm your backups exist, are current, and have been restored at least once as a test; ransomware is only a crisis if you cannot recover.
- Check that logins to systems holding patient information verify who the user is, and that you can review system activity if you ever need to reconstruct what happened.
- Date and keep the written result. A risk analysis you cannot produce is difficult to distinguish from one you never did, and it is meant to be updated, not filed once.