There’s a persistent belief among smaller medical practices that HIPAA enforcement is something that happens to hospital systems. The record says otherwise. The single most common finding in federal HIPAA settlements isn’t a sophisticated attack or a lost laptop — it’s the absence of a document most practices assume they already have.
That document is the security risk analysis. And unlike the sweeping Security Rule overhaul everyone’s been bracing for, this requirement isn’t proposed, pending, or delayed. It has been law since 2005.
What OCR Is Actually Enforcing
The HHS Office for Civil Rights runs a dedicated Risk Analysis Initiative, and it has been productive. Between January and August of 2025 alone, OCR announced 16 resolution agreements citing the same failure: not conducting an accurate and thorough assessment of the risks to electronic protected health information. OCR closed 2025 with 21 settlements, its second-highest total on record, and the pace has continued through 2026.
Small practices aren’t exempt from this attention — they’re overrepresented in it. In 2022, roughly 55% of OCR settlements landed on small practices, most often for missing risk assessment documentation and thin security awareness training.
The pattern is worth understanding. A practice suffers a ransomware incident or files a breach report. OCR investigates and asks for the current risk analysis. There isn’t one, or it’s a four-page form a vendor filled out in 2019. The settlement that follows is frequently about the missing analysis rather than the breach itself.
The incident opens the door. The paperwork determines what it costs.
What a Risk Analysis Is — and Isn’t
Here is where most practices go wrong. A security risk analysis is not:
- A vulnerability scan or penetration test
- A checklist your EHR vendor completed
- A generic template with your practice name typed at the top
- Something you did once when you implemented your EHR
It is a written, practice-specific assessment that identifies where ePHI lives in your environment, what could realistically go wrong with each of those systems, how likely and how damaging that would be, and what you’re doing about it.
Start with the scope problem
Nearly every deficient risk analysis fails at step one: it doesn’t account for everywhere ePHI actually lives. Walk your practice and inventory all of it:
- The EHR and practice management system, on-premises or cloud-hosted
- Email — nearly every practice has PHI sitting in mailboxes
- Imaging systems, PACS, and modality workstations
- Billing and clearinghouse systems, including any outsourced biller
- Laptops, tablets, and phones that access charts, including personal devices
- Backups, wherever they live
- Fax servers and scanned document folders on the file server
- Medical devices with storage or network connections
- Anything a third-party vendor touches on your behalf
That last one matters more each year. Your business associates’ security is part of your risk picture, and OCR has been explicit that third-party and cloud risk belongs in the analysis.
The Analysis Itself
Once scope is settled, the work is methodical rather than difficult:
1. Inventory ePHI and the systems holding it. Document each system, where it’s hosted, and who has access.
2. Identify threats and vulnerabilities for each. Ransomware, stolen credentials, a departing employee retaining access, an unpatched server, a lost phone, a vendor breach, fire and flood. Be specific to the system.
3. Assess current safeguards. What’s actually in place today — not what’s on the wish list.
4. Rate likelihood and impact. A simple high/medium/low on each is fine. Regulators want defensible reasoning, not a statistical model.
5. Determine the risk level and document it. This produces your prioritized list.
6. Write it down and date it. An undocumented analysis does not exist as far as an investigator is concerned.
7. Review it at least annually, and after anything significant changes — a new EHR, a practice acquisition, a move to a new location, a shift to remote scheduling staff.
The Part Everyone Misses: Risk Management
This is the distinction that separates practices that survive an OCR review from those that don’t.
The risk analysis identifies problems. Risk management is what you do about them. OCR has moved well past confirming a document exists — investigators now look for evidence that high-risk findings were actually remediated, and that someone is tracking progress over time.
A risk analysis identifying that your backups aren’t tested, followed by two years of untested backups, is arguably worse than no analysis at all. You’ve documented that you knew.
Practically, keep a remediation plan alongside the analysis: each significant risk, what you’re doing about it, who owns it, target date, status. When something can’t be fixed immediately — an old imaging workstation that can’t be patched — document the compensating controls and the reasoning. Documented acceptance of a risk with mitigations is defensible. Silence isn’t.
What Texas Adds on Top
Texas practices carry obligations beyond the federal baseline, and the rule is that the stricter requirement wins.
Texas HB 300 (Health and Safety Code Chapter 181) defines “covered entity” far more broadly than HIPAA — it reaches essentially any organization that comes into possession of PHI, which sweeps in businesses that assume they’re outside the rules entirely. It also mandates role-specific privacy training within 60 days of hire and at least every two years after, documented and signed by each employee. Generic annual training that ignores an employee’s actual duties doesn’t satisfy it.
Breach notification runs on a tighter clock than HIPAA’s. A breach affecting 250 or more Texas residents must be reported to the Texas Attorney General within 30 days of discovery, submitted electronically through the OAG’s portal. Affected individuals must be notified no later than 60 days. Federal HIPAA timelines don’t override these.
What’s Coming — and Why Not to Wait
The Security Rule overhaul proposed in January 2025 would strip the “addressable” designation from key safeguards and make them flatly required: encryption of ePHI at rest and in transit, MFA for systems accessing ePHI, annual penetration testing, 72-hour incident reporting, and stronger business associate oversight. HHS drew more than 4,000 comments, and the final rule has slipped — OMB’s agenda now points to July 2027.
That’s real breathing room, not a reason to sit still. Every one of those requirements is already a defensible answer to a risk your analysis will surface, and MFA and encryption in particular often determine whether an incident becomes a reportable breach at all.
Why This Matters in East Texas
Health care is the largest employment cluster in this region — UT Health East Texas and CHRISTUS Trinity Mother Frances are Tyler’s two biggest employers, and CHRISTUS Good Shepherd holds the same position in Longview. Around those systems sits a dense network of independent practices: family medicine, dental, orthopedics, imaging centers, behavioral health, home health agencies, and the billing companies serving all of them across Tyler, Longview, Palestine, Lufkin, and Texarkana.
Those independent practices are where the exposure concentrates. They hold the same protected data as a hospital system and answer to the same regulator — usually without anyone whose full-time job is compliance.
The good news is that this is finite work. A proper risk analysis for a small practice takes days, not months, and it makes every later security decision easier because you’re working from a prioritized list instead of a vendor’s pitch. Our healthcare IT and compliance services cover risk analysis, remediation planning, and the documentation that makes it hold up, backed by the same cybersecurity services we provide across Tyler, Longview, Palestine, Texarkana, Lufkin, and the DFW metro.
If you’re not certain when your risk analysis was last updated — or whether the document you have would satisfy an investigator — get in touch and we’ll take an honest look.
This Week in Security
UT San Antonio delays fall semester after a confirmed breach (August 18–24). UTSA took systems offline after detecting an intrusion, pushing the start of fall classes from August 19 to August 24 for roughly 42,000 students. Texas Cyber Command — the state’s new cyber agency — confirmed a breach occurred and credited the university for notifying the state early. UTSA says the attempt was caught at the network edge and has found no evidence of data theft, though the investigation continues. Two takeaways: edge detection is what turned this into a delay rather than a disaster, and Texas Cyber Command is now a real participant in incident response in this state. (KSAT, News 4 San Antonio)
CISA flags four actively exploited flaws, including a wormable Windows bug (August 18). Added to the Known Exploited Vulnerabilities catalog: a Microsoft IKE service flaw (CVE-2026-33824), a SharePoint authentication weakness (CVE-2026-55040), a VMware vCenter path traversal (CVE-2026-59310), and a macOS authentication bypass (CVE-2026-65400). Federal agencies had until August 21 to patch. Practices running on-premises SharePoint or VMware — common under older EHR and imaging deployments — should move these to the top of the patch queue. (CISA)
Stolen credentials, not a zero-day, drove a massive Azure directory leak (August 18–19). A threat actor selling under the alias “TheHatman” is offering employee directory data pulled from corporate Azure tenants — roughly 1.7 million records from McDonald’s, 425,000 from Vodafone, and hundreds of thousands more from TCS, HCL, Kyndryl, IHG, and others. Hudson Rock reviewed samples and found them consistent with genuine Azure directory exports. The intrusion vector isn’t confirmed, but researchers lean toward infostealer infections and stolen session tokens rather than any flaw in Azure. Some dumps reportedly include manager relationships, service accounts, and the names of Global Administrators — a ready-made map for spear-phishing whoever holds the keys. (Help Net Security, Cybernews)
Cl0p’s campaign against internet-facing vendor systems keeps expanding (ongoing through August). The Cl0p extortion group has been exploiting a critical flaw in internet-exposed PTC Windchill and FlexPLM systems (CVE-2026-12569), naming dozens of victims and, in mid-August, energy giant Shell — which is investigating a claimed 89GB theft. Cl0p steals data rather than encrypting it, so operations look completely normal while files are already gone. The lesson generalizes past manufacturing: any vendor-managed system reachable from the internet is part of your risk surface, which is precisely why business associate oversight keeps showing up in OCR findings. (BleepingComputer, Computer Weekly)
Microsoft patches a CVSS 10.0 Entra ID flaw, then walks back the “exploited” label (August 18–21). CVE-2026-69836, a deserialization bug in Entra ID, carried the maximum severity score and initially appeared in Microsoft’s bulletin as exploited in the wild. On August 21, Microsoft corrected that field to “No.” Microsoft fixed the issue on its own infrastructure, so customers need to take no action. A useful reminder to read the advisory before triggering an emergency change. (The Hacker News, BleepingComputer)
Dogwood Security LLC is a veteran-owned managed IT, cybersecurity, and physical security company based in Palestine, Texas, serving East Texas and the DFW metro.