OCR says 13 investigations are complete under its Risk Analysis Initiative

What happened

On April 23, 2026, the HHS Office for Civil Rights announced settlements with four regulated entities over separate ransomware breaches affecting more than 427,000 individuals. The release says the resolutions mark 19 completed investigations from ransomware breaches and 13 completed investigations under OCR’s Risk Analysis Initiative.

The four entities, with the payments the release lists, were a women’s health care provider network (Regional Women’s Health Group, $320,000), a medical imaging and screening provider (Assured Imaging Affiliated Covered Entities, $375,000), a third party administrator of employee benefit programs acting as a business associate (Consociate, Inc., $225,000), and the self funded employee benefits plan of a Connecticut based energy provider (Star Group, L.P. Health Benefits Plan, $245,000). The four payments total $1,165,000. OCR cited a failure to conduct an accurate and thorough risk analysis for each, along with impermissible disclosure for two and late notice to individuals for one. Each entity agreed to a corrective action plan that OCR will monitor for two years. The release also lists eight steps OCR recommends to covered entities and business associates, including periodic risk analysis, audit controls, encryption and workforce training.

What we have not verified

The counts above are as of April 23, 2026. OCR has announced further actions since, and we have not found an official updated total, so we are not stating a current figure.

Analysis: Read together, the numbers say that OCR has built a repeatable pattern: an incident leads to an investigation, and the investigation asks whether the risk analysis was accurate and thorough. The fact that one of the four was a business associate matters for clinics because the vendors that hold their records face the same question. For an ABA clinic the practical step is the same each time: locate the risk analysis, check its date, check that it names the systems and vendors that hold client records, and keep evidence that its findings were acted on. This is reporting, not legal advice.