US HIPAA Risk Analysis Initiative Enforcement

What happened

The HHS Office for Civil Rights launched the HIPAA Risk Analysis Initiative, a targeted enforcement programme specifically focused on healthcare organisations' inability to produce contemporaneous documentation of required safeguards. OCR's explicit stated enforcement position is stark: if you cannot produce documentation of a risk analysis, training records, or policy acknowledgments, OCR treats those safeguards as if they never existed. The initiative produced multiple enforcement settlements against organisations that were not accused of ignoring HIPAA, but of failing to document that they had complied with it at the time the required activities were performed. In each case, the organisation could not produce records proving the required compliance activities had been completed contemporaneously. The pattern is directly analogous to the GDPR accountability principle: the burden of proof rests with the covered entity, and standard document formats do not discharge it.