Privacy & Cybersecurity Law Blog

On February 19, 2026, the U.S. Department of Health and Human Services’ Office for Civil Rights (“OCR”) announced a $103,000 settlement with Top of the World Ranch Treatment Center (“TWRTC”), an Illinois substance use disorder treatment provider, to resolve alleged noncompliance with the HIPAA Security Rule’s risk analysis requirement.

According to OCR’s announcement, the investigation stemmed from a March 2023 breach report filed by TWRTC following a phishing attack. An unauthorized third party accessed electronic protected health information (“ePHI”) through a workforce member’s email account, compromising the ePHI of 1,980 patients.

OCR concluded that TWRTC failed to conduct an accurate and thorough risk analysis to assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI, as required by the HIPAA Security Rule.

In announcing the settlement, OCR Director Paula M. Stannard emphasized the importance of compliance with the Risk Analysis provision, particularly as regulated entities face increasing cybersecurity threats.

Settlement Terms and Corrective Action Plan

Under the resolution agreement, TWRTC agreed to:

• conduct and complete an accurate and thorough risk analysis;
• develop and implement a risk management plan to address identified risks and vulnerabilities;
• develop, maintain and revise written policies and procedures to comply with the HIPAA Privacy, Security and Breach Notification Rules; and
• provide annual HIPAA training to workforce members with access to ePHI.

OCR’s Risk Analysis Initiative

OCR identified this matter as its 11th enforcement action under its Risk Analysis Initiative, which focuses on compliance with the Security Rule’s requirement that covered entities and business associates conduct an accurate and thorough assessment of risks and vulnerabilities to ePHI.

OCR also reiterated practical steps regulated entities should take to mitigate cyber threats, including:

• identifying where ePHI resides and how it flows through systems;
• periodically conducting and updating risk analyses;
• implementing audit controls and regularly reviewing system activity;
• authenticating users seeking access to ePHI;
• encrypting ePHI in transit and at rest, where appropriate;
• incorporating lessons learned from incidents into security management processes; and
• providing role-based HIPAA training.

The investigation and settlement demonstrate OCR’s commitment to enforcing HIPAA requirements, particularly under the Security Rule.