OCR’s Latest HIPAA Guidance and Common HIPAA Pitfalls

OCR’s Latest HIPAA Guidance emphasises that HHS OCR will prioritise risk assessments and expand its investigations into risk management in 2026, as reported by Theresa Defino. Alisa Chestler and Layna Cook Rush of Baker Donelson summarise recommendations from HHS OCR’s January 2026 Cybersecurity Newsletter that regulated entities may want to pay increased attention to, including that patching is a required risk management activity and that legacy systems or unpatchable vulnerabilities are not excuses.

The guidance also highlights that unnecessary software and default accounts create hidden risk, security controls must be enabled and properly configured, and security baselines are strongly encouraged, with testing and evaluation deemed mandatory. The post also notes ten common HIPAA pitfalls identified by Eric E.

Kinder of Spilman, Thomas, & Battles, ranging from failing to perform an organisation-wide risk analysis and not following up on identified risks to issues such as denying patient access to records and improper PHI disposal. Read more about these recommendations at JDSupra.