OCR Enforcement Is Increasing

The HHS Office for Civil Rights (OCR) has been explicit: enforcement of HIPAA Privacy and Security Rules is a priority. In 2024, OCR resolved several high-profile cases involving small and mid-sized healthcare organizations, with settlements ranging from $25,000 to over $1.5 million. The message is clear that size is not a protection.

In 2025, OCR has indicated it will focus enforcement activity on three areas: right of access violations, inadequate business associate agreements, and insufficient security risk analyses.

Right of Access: The Most Cited Violation

OCR's Right of Access Initiative has resulted in dozens of settlements since 2019. Under HIPAA, patients must receive access to their medical records within 30 days of a request, at a reasonable cost. Common violations include:

  • Charging excessive copy fees
  • Requiring notarization not required by state law
  • Sending records to the wrong party
  • Ignoring or delaying requests beyond 30 days

Implement a written records request policy. Train front desk staff on how to handle requests and what the 30-day clock means in practice.

Business Associate Agreements

Every vendor who handles protected health information (PHI) on your behalf requires a signed Business Associate Agreement (BAA). This includes your EHR vendor, billing company, transcription service, answering service, and any cloud storage provider. Many clinics have outdated or missing BAAs for vendors added in recent years.

Conduct an annual BAA audit. List every vendor with PHI access. Confirm a current, signed BAA is on file for each one.

Security Risk Analysis

HIPAA requires covered entities to conduct and document a security risk analysis annually. This is not optional and it is not a one-time task. OCR frequently finds that small clinics have never completed one or completed one years ago without updating it following system or workflow changes.

If your clinic adopted a new EHR, moved to cloud-based storage, or expanded telehealth services since your last risk analysis, it is outdated. Update it this quarter.

2025 Policy Watch

OCR has also proposed updates to the HIPAA Security Rule that would strengthen requirements around multi-factor authentication, encryption, and incident response planning. While the proposed rule is not yet final, clinics should begin assessing their current security posture against these emerging standards to avoid a compliance gap once the rule takes effect.