Read enough OCR resolution agreements and a pattern emerges: organizations rarely get penalized for exotic attacks. They get penalized for skipping fundamentals the Security Rule has required since 2005. The same failures repeat across hospitals, health plans and business associates of every size.
The recurring five
- No enterprise-wide risk analysis — the single most cited failure. A vulnerability scan of one system is not a risk analysis of everywhere ePHI lives.
- Access that outlives the need: departed employees with live credentials, shared logins, no periodic access review.
- Missing encryption decisions: unencrypted laptops and drives, with no documented assessment of why encryption wasn't reasonable and appropriate.
- Audit controls nobody reads: logs exist but no one reviews activity involving ePHI, so incidents run for months.
- Business associates without agreements — PHI flowing to vendors with no BAA, or BAAs that were never updated.
Why the risk analysis dominates
The risk analysis is the control OCR asks for first because everything else depends on it: you can't claim your safeguards are reasonable if you never established what you're protecting and from what. A defensible one inventories every system touching ePHI, rates realistic threats, and feeds a documented risk management plan — refreshed when the environment changes, not once a decade.
Closing the gaps before someone else finds them
- Run (or commission) a genuine enterprise-wide risk analysis and keep the working papers.
- Automate deprovisioning and quarterly access reviews for anything touching ePHI.
- Encrypt portable devices by default; document the exception analysis where you don't.
- Assign log review as a named duty with a cadence — a control without an owner isn't a control.
- Inventory vendors handling PHI and reconcile the BAA list against it every year.
None of this is sophisticated — which is exactly why regulators show so little patience when it's missing.
