The HIPAA enforcement landscape in 2026 is materially different from 2021. The Office for Civil Rights has expanded its enforcement scope, increased the frequency of proactive audits, and demonstrated a willingness to pursue penalties against smaller covered entities, including home health agencies, that have historically received less scrutiny than hospitals and health systems.
Understanding what OCR is actually penalizing in 2026, not in theory, but in the specific cases that have been settled and publicly announced, is the most direct path to understanding where your agency is most exposed.
The Pattern: What OCR Cases Have in Common
Across the resolution agreements and civil monetary penalty decisions OCR has announced in 2024 and 2025, a consistent pattern emerges. Most enforcement actions share some combination of the following:
No risk analysis or inadequate risk analysis: This is the single most common finding across OCR enforcement actions. The requirement has been in place since 2005. OCR's patience for organizations that have not completed a risk analysis in 20 years has expired.
Failure to implement identified safeguards: The 2026 enforcement expansion specifically targets risk management, not just risk analysis. An organization that completed a risk analysis, identified that field devices were unencrypted and that MFA was not enforced, and then did nothing about those findings for three years is now in a worse position than an organization that never completed a risk analysis at all, because the documented awareness of the gap demonstrates willful neglect.
Breach followed by investigation of the underlying program: Most OCR enforcement actions are triggered by a breach notification. The investigation then examines whether the breach was caused by a failure to implement required safeguards and whether the organization had documented its compliance obligations. The breach is the trigger; the compliance program is the target.
Lack of BAAs with business associates: This is consistently cited in enforcement actions. Missing BAAs with EHR vendors, billing companies, and IT providers remain a recurrent problem.
Inadequate workforce training: Training records that show less than 100% completion, training that was conducted once and never repeated, or training that addresses only HIPAA Privacy Rule concepts rather than Security Rule safeguards all create exposure.
Specific Penalty Examples Relevant to Home Health
$1.19M - Workforce Training and Risk Analysis Failure
A covered entity in the home health adjacent sector received a $1.19 million civil monetary penalty following a breach investigation that revealed no workforce security training had been conducted in the two years preceding the breach, and the organization's risk analysis had not been updated for four years despite significant changes to the IT environment.
$90,000 - Small Organization Risk Analysis Failure
OCR has signaled that smaller covered entities are not immune from enforcement. A small covered entity received a $90,000 penalty specifically for failing to conduct a risk analysis, even though no breach occurred. This is a proactive audit outcome, not a breach investigation.
$350,000 - Lack of BAA
A covered entity that transmitted ePHI to a vendor without a signed BAA received a $350,000 penalty when the vendor experienced a breach and the covered entity could not produce the required agreement.