OCR Risk Analysis Initiative — active enforcement
OCR is investigating small practices that haven’t — and the proposed 2026 Security Rule will make it mandatory for everyone. CoreFolio uses AI to guide you through one in about 60 minutes and produces the dated PDF OCR expects to see.
For our first cohort of small US healthcare practices.
Two regulatory shifts that small practices keep missing — and that auditors and OCR keep finding.
April 2025 · OCR settlement
A small New York radiology practice paid OCR $350,000 in April 2025 — not for a breach, but for failing to conduct an accurate risk analysis. It was the sixth settlement under OCR’s Risk Analysis Initiative. The pattern is consistent: small practice, no breach, no current risk analysis on file.1
What the Risk Analysis Initiative means for you2026 rule update · annual cadence
The proposed 2026 Security Rule update would require every covered entity to complete a documented risk analysis every 12 months — no more “addressable” loopholes. The 2013 rule already requires one; the 2026 update just removes the wiggle room.2
You run a small practice. You know HIPAA matters. You also know:
You don’t need a $15K consultant. You need a clear, dated, defensible answer to “have we done our risk analysis this year?”
HIPAA’s Security Rule is 15,000 words of federal register text, and the proposed 2026 update adds more. CoreFolio uses AI to read it for you — translating each requirement into a plain-English question, citing the exact 45 CFR provision it maps to, and adapting the flow based on your practice type, EHR, and hosting setup. The output is yours, signed, dated, and traceable to the rule.
About 60 minutes of focused work produces the two artifacts OCR enforces against — plus a forward look at the proposed 2026 Security Rule. Each is dated, signable, and yours to file.
1 — The assessment under § 164.308(a)(1)(ii)(A)
A dated, downloadable PDF structured per NIST SP 800-30 — the methodology HHS points to. Maps to 45 CFR § 164.308(a)(1)(ii)(A), the exact provision OCR cites in every Risk Analysis Initiative settlement.
2 — The response under § 164.308(a)(1)(ii)(B)
The matching artifact OCR enforces alongside the analysis — a documented response to each identified risk. The user-facing surface is a 3-tier action plan (this week, vendor conversations, budget). EHR-specific scripts attach as annexes.
3 — A forward look at the 2026 rule
A side-by-side gap report against the proposed 2026 Security Rule (90 Fed. Reg. 898). Color-coded: likely meets, partial, gap — so you are not surprised when the rule finalizes.
Inside the Risk Management Plan
Things you can do today — turn on MFA for email, update your Notice of Privacy Practices, rotate shared logins.
Scripted questions for your EHR rep, IT provider, cloud host. Email templates included as annexes.
The items that need real money — network segmentation, pen testing, backup infrastructure — and when.
How HIPAA CoreFolio compares to the alternatives most small practices currently consider.
| Dimension | Free HHS SRA Tool | Typical consultant | HIPAA CoreFolio |
|---|---|---|---|
| Cost | Free | $5,000–$25,000+ | $49/month or $499/year |
| Time to complete | Days, alone | 4–8 weeks | About 60 minutes |
| Works on your phone | Windows only | n/a | Yes |
| Plain-English questions | Partial | Yes, in person | Yes |
| 2026 Security Rule alignment | Not updated | Varies | Yes |
| Vendor-specific action plan | No | Sometimes | Yes |
| Dated, downloadable artifact | Print-style | Yes | Yes |
| Year-over-year history | No | No | Yes |
Flat tiers. No setup fees. No per-seat creep. Cancel any time in one click.
No card required
Most practices choose this
or $499/year (save $89)
For larger practices
We can’t, and neither can anyone else. Compliance is a determination only HHS’s Office for Civil Rights makes, usually in response to an investigation. What we can do is give you a structured, dated, defensible answer to the question “have you assessed your risks this year, and do you have a plan?” That answer is what holds up.
HIPAA CoreFolio is self-assessment software. It is not legal advice, an HHS audit, or a certification. Your answers never leave your browser unless you choose to save them. Your reports are generated client-side and downloaded directly to you. If anything in your assessment is ambiguous, we say so — and we recommend you review it with your privacy officer or counsel.
We also publish the CoreFolio Brief — a free weekly federal HIPAA update written from primary sources (Federal Register, CFR, OCR press releases). It’s how we keep our own assessment current, and it’s how you can keep tabs on the rule without having to read it yourself. Subscribe in the footer.
We’re opening CoreFolio to a first cohort of small US healthcare practices — no credit card, no sales call.