The Findings Behind Most OCR Settlements — and Their Cost to Fix
Read enough OCR resolution agreements and the pattern becomes hard to miss. These are not exotic failures. They are the same few gaps, and the cost of closing each one in advance is a rounding error against the settlement.
Finding 1: No risk analysis, or one that does not qualify
The most frequently cited failure in the enforcement record. Two variants appear: no analysis at all, and a document that claims to be one but is not — usually a vendor checklist or an attestation letter with no threat identification, no likelihood and impact scoring, and no scope statement. Both read the same way to a reviewer. A genuine analysis for a single-location practice is a few thousand dollars; the settlements start six figures.
Finding 2: Unencrypted portable devices
A laptop in a car, a phone left in a taxi. Encryption is an explicit safe harbour: encrypted data that is lost is not a reportable breach at all. Full-disk encryption is built into every current operating system and costs staff time, not licences. This is the cheapest finding on the list to eliminate and among the most commonly penalised.
Finding 3: Business Associate Agreements never executed
The vendor list drifts. A new billing service, a new imaging provider, a cloud backup added quietly by whoever set it up. Reconciling the vendor list against accounts payable once a year takes an afternoon and reliably surfaces two or three vendors with ePHI access and no agreement on file.
Finding 4: Access not terminated when staff leave
Investigations frequently surface accounts still active months after separation, and former-employee complaints are a common trigger for an investigation in the first place. Tie access removal to the HR separation process with a timestamped checklist, and review quarterly. The evidence is the checklist with dates; a policy stating that access is removed promptly proves nothing.
Finding 5: Impermissible disclosure to the public
The modern version is a practice responding to a negative online review with clinical detail. Confirming that someone is a patient is itself a disclosure. Every practice needs a written rule that online reviews are answered with a generic invitation to contact the office and nothing more, and the person managing the practice's social accounts needs to have read it.
The arithmetic of fixing it early
Add up the preventive side: a risk analysis, endpoint encryption, an afternoon reconciling vendors, a termination checklist, and a written review-response rule. For a typical single-location practice that is a low five-figure investment in the first year and considerably less thereafter. Settlements in the enforcement record routinely reach six and seven figures before counting legal fees, the corrective action plan, and years of monitoring. The gap is not close.
Key takeaways
- 1.A vendor attestation letter is not a risk analysis and reviewers know it immediately
- 2.Encryption is a statutory safe harbour, which makes it the cheapest control on the list
- 3.Reconcile vendors against accounts payable annually to catch missing BAAs
- 4.Former employees are a common complaint source — terminate access same day, with evidence