Illinois Addiction Treatment Center Pays Penalty for Risk Analysis Failure
The HHS Office for Civil Rights (OCR) has resolved an alleged violation of the risk analysis provision of the HIPAA Security Rule with the Milan, IL-based addiction rehabilitation center, Top of the World Ranch Treatment Center, which has agreed to pay a financial penalty of $103,000 as part of the settlement agreement.
OCR launched an investigation of Top of the World Ranch Treatment Center after receiving a report of a phishing-related breach of the electronic protected health information (ePHI) of 1,980 patients on March 14, 2023. An employee responded to a phishing email, resulting in unauthorized access to a business email account on November 17, 2022. The account contained protected health information such as names, Social Security numbers, diagnoses, treatment information, and health insurance information.
OCR currently has a HIPAA enforcement initiative targeting noncompliance with the risk analysis provision of the HIPAA Security Rule. The initiative was launched in response to the frequent identification of risk analysis failures in its audits and data breach investigations. Large numbers of HIPAA-regulated entities were either failing to conduct a risk analysis or the risk analyses they completed were not comprehensive, as they did not cover all systems and locations containing ePHI.
Under this enforcement initiative, OCR has imposed 11 financial penalties for HIPAA risk analysis violations. If a risk analysis is not conducted, or if it is incomplete, it is almost inevitable that risks to the confidentiality, integrity, and availability of ePHI will not be identified and will therefore remain unaddressed, leaving the door open for malicious actors to access ePHI.
In addition to the financial penalty, Top of the World Ranch Treatment Center has agreed to implement a corrective action plan. The corrective action plan includes the requirement to conduct a comprehensive, organziation-wide risk analysis, develop a risk management plan to address any identified risks, and Top of the World Ranch Treatment Center must develop, implement, and maintain policies and procedures to ensure it complies fully with the requirements of the HIPAA Rules, and provide HIPAA training to the workforce on its policies and procedures.
“In a time where health care providers and other HIPAA-regulated entities are facing unprecedented cybersecurity threats, compliance with the HIPAA Risk Analysis provision is more essential than ever,” said OCR Director Paula M. Stannard. “Covered entities and business associates cannot protect electronic protected health information if they haven’t identified potential risks and vulnerabilities to that health information.”
This was the first HIPAA enforcement penalty to be announced by OCR this year, and follows a particularly active year of HIPAA enforcement, when 21 penalties were imposed to resolve violations of the HIPAA Rules. The outlook for 2026 looks similar, with OCR continuing with its enforcement initiatives targeting noncompliance with the HIPAA Right of Access of the HIPAA Privacy Rule and the risk analysis requirement of the HIPAA Security Rule. Stannard has also confirmed that, in addition to targeting risk analysis noncompliance, OCR will also be looking closely at risk management and will want to see evidence that risks identified during the risk analysis have been addressed in a timely manner.
