"In each case, OCR's investigation determined the company failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to ePHI in its systems.... These enforcement actions, and OCR's pursuit of the new Risk Analysis Initiative, teach some important lessons about risk analysis for covered entities and business associates looking to avoid falling within OCR's enforcement crosshairs."  MORE >>