The U.S. Department of Health and Human Services Office for Civil Rights (OCR) recently announced its 14th enforcement action under the Risk Analysis Initiative. A healthcare organization was fined $450,000 after a ransomware attack exposed 10,023 patients' records. The core finding: no Security Risk Assessment on file, no written security policies.
This is not an isolated case. It is part of a consistent pattern that OCR has been pursuing aggressively across the healthcare sector.
The Gap Most Practices Don't See
Most practice managers assume their IT provider handles compliance. In practice, the Security Risk Assessment is rarely on anyone's list until OCR comes knocking. IT providers keep your systems running. They are not responsible for producing the written documentation that federal regulators require.
At Vert Noir Corp, a managed security and HIPAA compliance firm serving dental practices in the Seattle and greater Washington State area, we work with healthcare practices on both sides of this equation: the technical controls that stop attacks, and the documentation that proves you took it seriously. One without the other is not enough.
What a Security Risk Assessment Actually Does
A proper SRA is not a compliance checkbox. It maps your actual network, identifies where patient data lives, and surfaces the gaps that attackers will find before you do. When combined with written security policies and ongoing monitoring, it forms the foundation of a defensible compliance program.
The Bigger Picture
Security and compliance are ongoing commitments, built into how a sustainable business operates every day. OCR's 14 consecutive Risk Analysis enforcement actions make clear that this is not a one-time project. Practices that treat it as such are the ones that end up in enforcement actions.
If you are a dental practice or healthcare organization in the Seattle area and are unsure when your last Security Risk Assessment was completed, or whether it reflects your current systems, that is worth addressing before OCR makes it urgent.
About Vert Noir Corp
Vert Noir Corp provides managed security and HIPAA compliance services for dental practices in the Seattle metropolitan area, including King, Snohomish, and Pierce counties. Our services cover Security Risk Assessments, Business Associate Agreement management, staff security training, network security, and continuous monitoring. We are a certified Fortinet partner based in Washington State.