A risk analysis is the process of identifying and documenting potential threats and vulnerabilities to electronic Protected Health Information (ePHI) — essentially, a security audit that produces a list of gaps. Risk management is what your organization actually does about those gaps: patching systems, restricting access, updating policies, training staff, and documenting every corrective action with dates and owners.

Until recently, OCR enforcement focused primarily on whether a risk analysis existed. In 2026, OCR has formally expanded its enforcement initiative to include risk management — meaning auditors now evaluate whether your practice acted on what the analysis found, not just whether the analysis was completed. A two-year-old risk assessment with no attached remediation plan is now treated as a compliance failure, even if the assessment itself was thorough. For Phoenix and Scottsdale practices, this shift is the single most important HIPAA development of the year.

HIPAA penalties are tiered by the level of culpability. At the most serious tier — willful neglect that is not corrected — OCR can impose fines of up to $73,011 per violation per day. In 2025, OCR levied more than $6.6 million in HIPAA fines, with individual settlements ranging from $80,000 to $3 million. One settlement of $90,000 involved a practice with fewer than 15,000 affected patients that had simply never conducted a risk analysis.

Beyond federal fines, Arizona’s updated data breach notification law imposes a 45-day notification deadline and can trigger separate state-level enforcement actions. For most independent practices, clinics, and behavioral health groups in the Valley, a single OCR enforcement action — combined with breach notification costs, legal fees, and reputational damage — can be existential. Proactive compliance management is significantly less expensive than responding to enforcement.

Yes — if your managed IT provider has any access to systems that store, process, or transmit ePHI, a signed Business Associate Agreement (BAA) is a federal requirement under HIPAA. This includes your managed IT provider, EHR platform, cloud backup service, billing software, email platform, and any other vendor whose systems touch patient data in any form.

BAA gaps are consistently one of OCR’s top three enforcement findings. A BAA must define the vendor’s security obligations, breach notification timelines (typically within 60 days of discovery), and what happens to ePHI when the agreement ends. Many practices have outdated BAAs that predate cloud migrations or EHR upgrades — meaning the agreement no longer covers the systems actually in use. Coeus Consulting’s compliance advisory services include a full BAA inventory and gap review as part of onboarding for every healthcare client.

The HHS HIPAA Security Rule does not specify a fixed interval — it requires that the risk analysis be kept “accurate and thorough” as the organization and its environment change. In practice, OCR’s current enforcement posture treats any assessment older than 12 months as presumptively outdated, particularly if the practice has changed EHR systems, added cloud services, hired or terminated staff with ePHI access, or experienced any security incident in the interim.

Beyond the annual baseline, a new risk assessment should be triggered any time a significant operational or technology change occurs: a new vendor relationship, a merger, a new clinical location, a ransomware incident, or a change in how ePHI is stored or transmitted. For most practices in the Phoenix metro, an annual formal assessment plus continuous monitoring through a managed IT and compliance partner is the most defensible posture under current OCR scrutiny.

A healthcare-focused managed IT and compliance partner like Coeus Consulting does far more than keep the network running. For HIPAA compliance specifically, a qualified MSP provides: continuous monitoring of all systems that store or transmit ePHI; enforcement of multi-factor authentication across all user accounts; automated patch management with documented timelines that satisfy OCR’s remediation requirements; audit logging on servers, workstations, and cloud platforms; and staff security awareness training with completion records.

On the compliance side, Coeus maintains the ongoing evidence trail that OCR now expects to see — documented risk assessments, remediation plans with owner assignments and target dates, BAA inventories, and policy update logs — so that if an auditor or ransomware incident triggers an investigation, your practice can produce a complete, current compliance file rather than scrambling to reconstruct one. Our Coeus Codex framework is specifically designed to create this “Known State” for healthcare SMBs across Greater Phoenix, Scottsdale, Tempe, and Chandler.