Who Needs a HIPAA Risk Assessment? It’s Not Just Healthcare Companies

A Retailer, Fined $450,000, Under HIPAA

In June 2026, the HHS Office for Civil Rights (OCR) announced a $450,000 settlement with Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans — the employer-sponsored group health plan of Spencer Gifts LLC, a national retail company. The case started with a November 2021 ransomware attack that encrypted the company’s servers, including systems storing the plan’s protected health information (PHI). PHI of 10,023 individuals was potentially affected, and OCR determined the plan had failed to conduct an accurate and thorough risk analysis before the breach ever happened.

Spencer Gifts is not a healthcare provider. It became a HIPAA-regulated entity because its employee benefits program is an employer-sponsored group health plan — and under HIPAA, health plans are covered entities in their own right. This is why compliance professionals say HIPAA applies to the data and the plan, not the industry: any business that sponsors a group health plan, self-insured or not, is in scope, along with every vendor that touches the plan’s PHI.

Who Has to Do a HIPAA Risk Assessment?

The Security Rule (45 CFR Part 164, Subpart C) applies to two groups:

• Covered entities — health plans (including employer-sponsored group health plans), health care clearinghouses, and providers that transmit health information electronically (billing Medicare alone makes a practice a covered entity).
• Business associates — any entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity: billing services, cloud EHR and email vendors, medical answering services, accountants who touch PHI, and even their subcontractors. Business associates have been directly liable for Security Rule compliance since the 2013 HIPAA Omnibus Rule.

If you process, store, transmit, or touch ePHI in any of those roles — even as a side effect of other work, like an IT provider to dental practices — the risk analysis requirement applies to you.

What the Requirement Actually Says

The Security Rule’s administrative safeguards standard — 45 CFR § 164.308(a)(1)(ii)(A) — requires an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.” OCR and HHS publish a free, official Security Risk Assessment Tool (SRA v3.7) — 127 questions across 7 sections — designed for small and medium organizations to work through themselves.

There is no set calendar deadline, but the analysis must stay current. OCR recommends conducting it periodically and whenever your environment changes: new systems, new locations, remote work, new vendors, or after any incident. In OCR’s words, the goal is that Security Rule provisions are “implemented before a cyberattack occurs” — the Spencer Gifts plan, like most enforcement cases, was cited for not having the analysis done prior to its breach.

What OCR Expects Beyond the Questionnaire

A completed questionnaire alone rarely ends an investigation. OCR’s settlement recommendations consistently point to the full security management cycle:

• Know where ePHI exists — how it enters, flows through, and leaves your systems
• A documented risk analysis plus a risk management plan that addresses what the analysis found
• Audit controls and regular review of system activity
• Authentication and encryption — unique user IDs, and ePHI encrypted in transit and at rest where appropriate
• Ongoing workforce training specific to each person’s job duties

Under OCR settlements, entities also agree to a monitored corrective action plan — typically two years of reporting and re-training. The cost of the settlement is usually the smaller part; the CAP is the real burden.

The Bottom Line

If your organization sponsors a group health plan, bills electronically for care, or touches PHI for any covered entity, the risk analysis requirement is not optional — and the issued employer identification number (EIN) that appears on your HIPAA electronic transactions is how regulators track you through the system. The question is not whether you are a “healthcare company”; it is whether you create, receive, maintain, or transmit ePHI. If you do, run the assessment — and keep the documentation.