Compliance gaps and OCR points of emphasis for Critical Access Hospitals
Since 2019, HHS reports large breaches from hacking up 89% and ransomware-related large breaches up 102%. Critical Access Hospitals face the same OCR enforcement as large systems, with far fewer resources.
The core questionCould your hospital show OCR, today, a current risk analysis, signed BAAs, and documented training?
Start here
Three rules, one standard
Minimum necessary: need to know, not nice to know
Limit PHI access, use, and disclosure to what is reasonably necessary for the intended purpose. Exceptions include treatment disclosures and requests by providers, disclosures to patients, and most authorized or legally required disclosures. PHI is identifiable health information in any form: paper, electronic, or spoken.
Privacy RuleUse and disclosure of PHI, and patient rights.
Security RuleAdministrative, physical, and technical safeguards for ePHI.
Breach RuleTimely notification of affected individuals, HHS, and, when applicable, the media following a reportable breach of unsecured PHI.
Example role
Typically needs
Typically not needed
Front desk
Demographics, insurance, appointments
Clinical notes, full chart
Billing and coding
Charges, codes, billed diagnoses
Psychotherapy notes
Nursing
Patients in their care, coverage, or consults
Patients outside their duties
Lab and radiology
Orders and results for their tests
Unrelated medication history
Illustrative access levels. Staff may have legitimate needs outside these examples for coverage, consultation, or other authorized duties.
Where programs fall short
Six common compliance gaps
01
Risk analysisHospitals may lack a current, comprehensive risk analysis covering all systems, locations, and vendors that create, receive, maintain, or transmit ePHI. It remains a leading OCR enforcement concern.
02
Business associatesUnsigned BAAs and untracked vendor access. HIPAA requires written assurances and appropriate safeguards from every vendor that handles PHI.
03
Access controlsBroad ePHI access, no role-based controls, and shared logins. In a small community, curious access to a neighbor’s chart is a real risk.
04
Incident responseNo documented, tested incident response and breach procedure. OCR investigates ransomware incidents as potential breaches.
05
Training recordsTraining is required for the workforce and when policies materially change. Recurring, documented sessions show it was done.
06
Devices and mediaUnencrypted, uninventoried laptops, drives, and phones. Encryption is addressable under the current Security Rule, so document the decision.
Action plan
A 30-60-90 day plan
30Days
Assess and assignAssess gaps against the core program components, document Privacy and Security Officer designations, and audit vendors for missing BAAs.
60Days
Analyze and protectUpdate the risk analysis and start a risk management plan. Implement MFA for remote access, privileged accounts, and systems containing ePHI where supported; document compensating safeguards where MFA is not feasible.
90Days
Test and trackTest the incident response and breach plan, encrypt mobile devices and media, track remediation of identified risks, and hold documented training.
OCR points of emphasis
What OCR is watching
Risk analysis. A genuine, organization-wide assessment, not a checklist.
Right of access. Giving patients timely access to their own records.
Ransomware and cybersecurity. Encryption, patching, and MFA are areas of scrutiny.
Business associate oversight. Appropriate assurances and safeguards, not just a signed form.
A note on penalties.OCR enforces HIPAA with civil penalties in four tiers, from unknowing violations to uncorrected willful neglect, adjusted each year for inflation. Certain knowing HIPAA violations may result in criminal prosecution by the Department of Justice.
Enforcement examples
What the gaps have cost
$5.5MEmployee accessImproper accessWorkforce log-ins were misused to view patient data, and audit controls did not catch it (2017).
HIPAA 101: Closing the Common Gaps
Compliance gaps and OCR points of emphasis for Critical Access Hospitals
Since 2019, HHS reports large breaches from hacking up 89% and ransomware-related large breaches up 102%. Critical Access Hospitals face the same OCR enforcement as large systems, with far fewer resources.
The core questionCould your hospital show OCR, today, a current risk analysis, signed BAAs, and documented training?
Three rules, one standard
Minimum necessary: need to know, not nice to know
Limit PHI access, use, and disclosure to what is reasonably necessary for the intended purpose. Exceptions include treatment disclosures and requests by providers, disclosures to patients, and most authorized or legally required disclosures. PHI is identifiable health information in any form: paper, electronic, or spoken.
Illustrative access levels. Staff may have legitimate needs outside these examples for coverage, consultation, or other authorized duties.
Six common compliance gaps
A 30-60-90 day plan
What OCR is watching
A note on penalties. OCR enforces HIPAA with civil penalties in four tiers, from unknowing violations to uncorrected willful neglect, adjusted each year for inflation. Certain knowing HIPAA violations may result in criminal prosecution by the Department of Justice.
What the gaps have cost
Settlement amounts from HHS OCR resolution agreements, 2015–2017. Entities are not named.
Three checks for your program
Talk through your HIPAA program
Jonathan Pantenburg, MHA · Principal
JPantenburg@wintergreenme.com808.853.8086
Current as of October 2026. Sources: 45 CFR Parts 160 and 164 (Privacy, Security, and Breach Notification Rules); HHS OCR breach and enforcement data.