OCR continues to highlight the need for thorough risk analyses after its latest breach settlement with Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans, the employer‑sponsored health plan of the retail chain.
Settlement details and the breach
The Office for Civil Rights announced that the plan will follow a two‑year corrective action plan monitored by OCR. The settlement stems from a ransomware incident discovered after the plan filed a breach report on Jan. 24, 2022. The report said an unauthorized actor accessed the network in Nov. 2021, encrypted data on servers that stored electronic protected health information (ePHI), and demanded a ransom.
OCR’s findings on risk analysis failures
The agency found the plan violated several HIPAA provisions. First, it failed to conduct an accurate and thorough risk analysis to identify potential vulnerabilities to the confidentiality, integrity, and availability of ePHI before the incident. Second, the plan did not implement reasonable policies and procedures required by the Privacy, Security, and Breach Notification Rules.
Related: AI listening aids rural New Mexico hospital care
According to the HIPAA Security Rule, a risk analysis must assess the likelihood and impact of threats to ePHI. OCR’s statement said that regulated entities “should ensure these protections are firmly in place well before a cyberattack occurs.” The settlement requires the plan to revise its policies, train its workforce, and adopt technical safeguards such as audit controls, encryption, and authentication mechanisms.
Broader pattern of enforcement
This is the 14th enforcement action under OCR’s Risk Analysis Initiative, a program launched by the current administration to curb breaches linked to weak or missing risk analyses. The initiative has persisted through the previous administration, with enforcement actions becoming more explicit under the current director, Paula M. Stannard.
Industry reaction
Cybersecurity firm Clearwater, which tracks OCR activity, said the agency’s consistent focus on risk analyses reflects growing concerns about ransomware and supply‑chain threats. “Now under the leadership of OCR Director, Paula M. Stannard, it is clear that a full risk analysis is vital in today’s environment,” the firm noted.
Related: Asian Chemical Biology Conference (ACBC)
Some compliance experts caution that while OCR’s enforcement signals seriousness, smaller covered entities may struggle to meet the detailed requirements without significant investment. “The rules are clear, but the resources needed to implement them can be a hurdle for many plans,” one analyst remarked, emphasizing the balance between regulatory compliance and operational capacity.
Corrective actions outlined in the settlement
- Conduct an accurate and thorough risk analysis to identify vulnerabilities to ePHI.
- Review and revise privacy, security, and breach‑notification policies as needed.
- Provide regular, role‑specific HIPAA training to all workforce members.
- Implement audit controls, regular system‑activity reviews, and authentication mechanisms.
- Encrypt ePHI in transit and at rest, and incorporate incident lessons into security management.
The corrective action plan also requires periodic updates to the risk analysis and a risk‑management plan to address identified risks. OCR will monitor compliance for two years, and the plan must demonstrate that audit logs and encryption are operational.
What the settlement means for covered entities
Beyond the immediate financial penalty, the settlement signals OCR’s expectation that covered entities adopt proactive security measures.
Related: OIG Report Reveals High Denial Rates in Medicare Advantage Long-Term Care
For organizations that have not yet formalized a risk analysis, the settlement serves as a reminder that “effective cybersecurity starts with Security Rule compliance,” as Stannard phrased it. The requirement to train staff and regularly review system activity adds operational layers that may feel cumbersome, but they align with the broader regulatory intent to protect health information before breaches occur.
In short, the Spencer Gifts settlement adds another data point to OCR’s enforcement record, reinforcing that risk analyses are not optional. Companies that ignore the agency’s guidance risk both financial penalties and the reputational fallout of exposed health data.
