Briefing
The HIPAA Security Rule requires an accurate and thorough assessment of risks to electronic protected health information. OCR's Risk Analysis Initiative keeps enforcing it. On February 19, 2026, OCR settled with Top of the World Ranch Treatment Center for $103,000 after a phished mailbox exposed 1,980 patients' information; HHS called it the 11th action under the initiative. On April 23, 2026, OCR announced four ransomware settlements totaling $1,165,000, affecting over 427,000 people. In all four, OCR found a failure to conduct an accurate and thorough risk analysis.
In clinics we wire and support, the risk analysis usually covers the EHR and email and stops there. Patient information also sits in voicemail, call recordings, fax servers and fax-to-email routes, on-call forwarding to personal mobiles, and the softphone a provider uses from home. Those systems were installed by a phone vendor and rarely appear in the HIPAA binder.
HHS also states that it does not endorse or recognize private Security Rule certifications. A purchased badge does not replace the analysis.
What to do
- Map where ePHI enters, moves and leaves, and include voice: voicemail storage, recordings, fax, after-hours forwarding and softphones.
- For each location, record realistic threats, current safeguards, likelihood, impact and a risk rating.
- Build the risk management plan from the ratings. OCR's corrective action plans in 2026 required one, not just the analysis.
- Set triggers for updates: a new phone system, a new location, a new vendor, or an incident.
- Include a technical review of the network itself, not only interviews.
How to verify
- Hand someone your current dated analysis. If it does not mention the phone system, it is incomplete.
- Check voicemail and recording retention settings against your written policy.
- Confirm business associate agreements exist for your phone, fax and hosting vendors.
- Compare the risk register owners against current staff. Every risk should have a current owner.
Sources
- HHS, Guidance on Risk Analysis
- HHS OCR, Top of the World Ranch Treatment Center settlement, Feb 19, 2026
- HHS OCR, Four HIPAA Security Rule ransomware settlements, Apr 23, 2026
- HHS FAQ, Are we required to certify our organization's compliance with the Security Rule?
Questions about your phones, network or IT? Contact Texwan.