OCR HIPAA Security 2026 Conference Presentations: Safeguarding Health Information: Building Assurance

September 5, 2026adminHIPAA News Today0

The Safeguarding Health Information: Building Assurance through HIPAA Security 2026 conference took place at the start of September 2026 at the NIST campus in Gaithersburg, Maryland. The event was co-hosted by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the National Institute of Standards and Technology (NIST). The sessions covered enterprise-wide security risk analysis, Internet of Things (IoT) security in healthcare, and managing cybersecurity risks.

HHS Office for Civil Rights Updates

Presenter: Paula M. Stannard, Director, Office for Civil Rights (HHS)

Director Stannard outlined OCR’s HIPAA and Part 2 priorities, framed around being agile and strategic, executing high-impact enforcement, and building resilience through compliance. She presented breach trend data covering 2021 through 2025: reported breaches affecting 500 or more individuals ranged from 650 to 746 per year over that period, while individuals affected spiked sharply in 2023 and 2024, reaching roughly 173 million and 287 million respectively before dropping to approximately 46 million in 2025. Hacking and IT incidents, including ransomware, account for the large majority of these reports, and network servers and email remain the leading breach locations. Stannard reviewed 13 recently announced HIPAA enforcement actions dated between July 2025 and August 2026, with settlements ranging from $10,000 to $552,250. She also detailed two active enforcement initiatives: the Right of Access Initiative, which has produced 55 completed enforcement actions and a new focus on parent and personal representative access, and the Risk Analysis and Management Initiative, which has produced 14 completed enforcement actions and was recently expanded to cover the risk management requirement directly. On artificial intelligence, Stannard stated that regulated entities must ensure new technologies, including AI, comply with the HIPAA Rules, starting with the Security Management Process: a current risk analysis, defined access controls for anyone with access to electronic protected health information (ePHI), and a business associate agreement executed before an AI vendor’s service begins.

Key Takeaways

OCR’s enforcement initiatives target risk analysis, risk management, and right of access as the most common points of failure.
A compliant HIPAA risk analysis is a prerequisite for using AI tools that touch ePHI, and any AI vendor is treated as a business associate.
Reported large breaches are increasingly hacking and network-based rather than physical, a trend later confirmed independently. Comparing OCR’s historical breach portal data from September 2009 through December 2025 against the first seven months of 2026 shows hacking and IT incidents growing from 52 percent of reported large breaches to 75 percent, while network servers as a breach location grew from 39 percent to 68 percent and theft fell from 18 percent to roughly 1 percent.

Health Sector Cybersecurity Threat Briefing

Presenter: Joshua Justice, Cyber Threat Intelligence Manager, Health-Information Sharing and Analysis Center (H-ISAC)

Joshua Justice presented H-ISAC’s annual threat landscape briefing for the health sector. An H-ISAC survey of nearly 250 health sector security professionals found ransomware, phishing, third-party or partner breaches, data breaches, and zero-day exploits as the top five threats of 2025, while the outlook for 2026 adds AI-enabled attacks to that list. Ransomware activity in the first quarter of 2026 nearly matched the volume seen in the fourth quarter of 2025 and ran roughly 30 attacks ahead of the first quarter of 2025. H-ISAC tracked 234 ransomware events against the health sector so far in 2026, with Qilin, Gentlemen, INC Ransom, NightSpire, and Insomnia as the most active groups. Justice covered two law enforcement takedowns, the Raccoon O365 phishing-as-a-service operation and the Tycoon 2FA credential-phishing kit, and reviewed nation-state activity including North Korean IT worker fraud schemes and the use of cybercriminal proxies by nation-states pursuing “gray zone” tactics. He also described threats tied to the Middle East conflict, including denial-of-service attacks, data wiping, and targeting of operational technology, along with medical device concerns such as insecure design flaws in Contec CMS8000 patient monitors, legacy Windows 10 exposure following its 2025 end of support, and continued exposure of PACS and DICOM imaging infrastructure. On social engineering, Justice flagged ClickFix and FileFix techniques and QR code “quishing” as emerging tactics, alongside data on the most frequently observed malicious activity tags and targeted alert types. He closed with H-ISAC’s Analyst Threat Landscape Awareness System, a platform supporting collaboration across multiple ISACs, and a set of free threat intelligence resources.

Key Takeaways

AI-enabled attacks moved into H-ISAC’s top five threat category for the first time in the 2026 outlook.
Ransomware volume against the health sector in 2026 is tracking above prior-year levels, with a small number of groups responsible for most attacks.
Legacy medical devices and imaging infrastructure remain a persistent exposure point.
The briefing also raised concern about rapidly advancing AI models lowering the technical barrier for sophisticated attacks, a theme OCR’s later note to the reader addresses further below.

Administration for Strategic Preparedness and Response Cyber Updates

Presenter: Dr. Brian Mazanec, Deputy Assistant Secretary (HHS ASPR)

Dr. Mazanec presented data showing the Healthcare and Public Health (HPH) Sector as one of the most targeted critical infrastructure sectors, citing over 2,200 cyber attacks triaged by the ASPR cyber team in 2025, 238 ransomware incidents and 206 data breaches reported in 2024, and an average cost per breach of $9.77 million. He described structural vulnerabilities including low tolerance for downtime in patient care settings, complex interconnected ecosystems averaging 26,000 connected devices per hospital, and outdated systems, noting that roughly half of oncology, pharmacology, and laboratory departments run outdated Windows systems and 85 percent of medical devices operate on outdated legacy networks. Mazanec outlined HHS’s role as Sector Risk Management Agency under the FY2021 National Defense Authorization Act, the National Cybersecurity Incident Response Plan, and the HHS Cyber Gateway as a central hub for HPH-specific tools including the Cybersecurity Performance Goals (CPGs), the Cybersecurity Weekly Newsletter, and the Knowledge on Demand training platform. He closed with contact points for reporting a cyber attack, including the FBI’s Internet Crime Complaint Center, CISA’s Incident Reporting System, and the HHS 24/7 Operations Center.

Key Takeaways

The HPH Cybersecurity Performance Goals divide protections into Essential Goals, a baseline floor, and Enhanced Goals, for organizations building more mature defenses.
Legacy infrastructure and connected medical devices remain the sector’s largest structural exposure.
Organizations should have a documented incident response plan that identifies who to contact, including CISA and the HHS Cyber Gateway, before an attack occurs.

HHS Cybersecurity Activities and Resources Panel

Participants: Timothy Noonan (Moderator), Deputy Director, Health Information Privacy, Data, and Cybersecurity Division (HHS OCR); Dr. Brian Mazanec (HHS ASPR); Andrew Carney, Program Manager, Resilient Systems (HHS ARPA-H); Avinash Shanbhag, Deputy National Coordinator for Health IT (HHS ONC); Nicholas Heesters, Senior Advisor for Cybersecurity (HHS OCR)

The panel connected the cybersecurity remits of four HHS components: OCR’s Security Rule guidance and enforcement, ASPR’s HHS Cyber Gateway and incident response coordination, ONC’s health IT standards work, and ARPA-H’s research investments through programs including DIGIHEALS and UPGRADE, which funds efforts to harden medical devices against cyber threats.

Key Takeaways

Organizations facing a cybersecurity incident have distinct points of contact across OCR, ASPR, and ONC depending on the nature of the issue.
ARPA-H’s UPGRADE program is a federal research investment specifically targeted at medical device cybersecurity.

Post-Quantum Cryptography Panel

Participants: John Dombrowski (Moderator), Senior Cybersecurity Engineer, MITRE; Dustin Moody, Mathematician, Cryptographic Technology Group (NIST); Stephen Craig, Senior Technical Architect, New York-Presbyterian Hospital; Nathan Lesser, Vice President and Chief Information Security Officer, Children’s National Hospital

The panel addressed the threat a large-scale quantum computer poses to current public-key cryptography, since Shor’s algorithm would break RSA, ECDSA, ECDH, and DSA, while symmetric-key systems face a smaller impact from Grover’s algorithm. NIST finalized its first set of post-quantum cryptography standards, FIPS 203, 204, and 205, with HQC selected in 2025 as an additional algorithm. Executive Order 14412 directs federal agencies to prioritize migration to quantum-resistant cryptography with a goal of mitigating quantum risk by 2035. The panel discussed “harvest now, decrypt later” risk, where encrypted data intercepted today could be decrypted once a capable quantum computer exists, and the health sector CISOs on the panel addressed the practical challenges of inventorying cryptographic assets and planning migration timelines in hospital environments.

Key Takeaways

Organizations handling data with long-term sensitivity should begin cryptographic asset inventories now, since migration takes years and standards continue to evolve.
FIPS 203, 204, and 205 are the current NIST post-quantum cryptography standards for key establishment and digital signatures.
The federal migration goal is 2035, but healthcare organizations with legacy systems and medical devices face longer practical timelines.

Privacy Enhancing Technologies and Genomic Data Threats

Presenters: Dr. Gary Howarth, Privacy Engineering Program Manager (NIST); Dr. Christine Task, Director, Privacy Solutions and Synthetic Data, Knexus Research

Howarth opened by demonstrating that simple redaction does not protect personally identifiable information, citing research showing 87 percent of the U.S. population can be re-identified using only three quasi-identifiers such as zip code, birth year, and sex. He introduced the NIST Privacy-Enhancing Technologies (PETs) Testbed, which develops model problems from real-world use cases, benchmark datasets, and evaluation metrology to assess whether a given technology preserves both privacy and data utility. Task covered privacy-preserving record linkage, which allows multiple data holders to query combined data without exposing their own records, and differential privacy, a mathematical framework detailed in NIST Special Publication 800-226 that limits how much any single record can affect an analysis. Both speakers addressed federated learning for genomic data, where models train across decentralized data silos rather than pooling raw data centrally, and outlined four vulnerability classes: membership attacks, data reconstruction attacks, model inversion attacks, and model evasion or poisoning attacks. Task closed with a discussion of synthetic data for deidentification, distinguishing basic synthetic data from high-fidelity synthetic data that preserves population-level statistical relationships for research use.

Key Takeaways

Redaction alone does not satisfy a privacy protection standard, since auxiliary data sources can re-identify individuals from a small number of remaining fields.
Federated learning reduces but does not eliminate privacy risk, since attackers can sometimes reconstruct training data from shared model updates.
NIST Special Publication 800-226 provides the current federal guidance on evaluating differential privacy guarantees.

Federal Trade Commission Health Privacy and Security Updates

Presenter: Robin Rosen Spector, Attorney, Division of Privacy and Identity Protection (FTC)

Robin Rosen Spector reviewed the FTC’s Section 5 authority over unfair or deceptive practices, which extends to both HIPAA-covered and non-covered entities, and the Health Breach Notification Rule, which applies to vendors of personal health records and related third-party service providers rather than to HIPAA-covered entities directly. She reviewed a series of enforcement actions: Hims & Hers, where a telehealth provider allegedly shared sensitive health information with advertisers while misrepresenting that the information would stay private; Monument, the first case brought under the Opioid Addiction Recovery Fraud Prevention Act; Cerebral, where a mental health subscription service allegedly shared data on nearly 3.2 million consumers with platforms including LinkedIn, Snapchat, and TikTok; and additional cases involving GoodRx, BetterHelp, Premom, Flo Health, Verkada, Vitagene, Chegg, SkyMed, and Henry Schein. Remedies across these cases included prohibitions on future misrepresentations, mandated privacy and security programs, monetary penalties, and consumer redress.

Key Takeaways

FTC Section 5 authority reaches health data practices even when HIPAA does not apply, including consumer health apps and telehealth platforms.
Several cases centered on undisclosed data sharing with advertising and social media platforms rather than on a data breach.
Displaying a HIPAA compliance seal or claiming a certification a business does not have is itself a basis for an FTC deception claim, as alleged in the SkyMed case.

HIPAA Enforcement Update from the HHS Office for Civil Rights

Presenter: Timothy Noonan, Deputy Director, Health Information Privacy, Data, and Cybersecurity Division (HHS OCR)

Noonan reviewed three recent Security Rule settlements: OSF HealthCare, a $552,250 settlement following a 2021 ransomware incident affecting 53,907 individuals; Spencer Gifts, LLC, a $450,000 settlement following a 2021 ransomware incident affecting 10,023 individuals; and Star Group L.P. Health Benefits Plan, a $245,000 settlement following unauthorized network access affecting 9,316 individuals. Each case cited a deficient risk analysis among the potential violations, alongside issues including impermissible disclosure and inadequate policies and procedures. Noonan stated that OCR has completed 21 ransomware investigations and 14 investigations under the Risk Analysis Enforcement Initiative, and he distinguished a gap analysis, which compares practices against a checklist, from a risk analysis, the more rigorous exercise the Security Rule requires. He closed by restating that organizations should not wait for a breach or a completed OCR investigation before conducting a compliant risk analysis, and that breach notification to affected individuals is due no later than 60 calendar days after discovery.

Key Takeaways

OCR requests a risk analysis in every Security Rule investigation it opens.
A gap analysis does not satisfy the Security Rule’s risk analysis requirement.
The 60-day breach notification deadline applies regardless of an organization’s size.
A compliant risk analysis must assess risk to ePHI at three stages: where it is created or enters the organization, where it flows within the organization, and where it leaves the organization, and an assessment covering only one of these stages does not meet the standard.

Future of Health IT: Office of the National Coordinator for Health IT Updates

Presenter: Steven Posnack, Principal Deputy National Coordinator for Health IT (HHS ONC)

Posnack traced the ten-year path from the 21st Century Cures Act through the HTI-1 Final Rule and USCDI v3, and introduced USCDI+, an initiative extending the core data set to meet program-specific needs in areas such as maternal health, behavioral health, and cancer. He reviewed the Trusted Exchange Framework and Common Agreement (TEFCA), now connecting 11 Qualified Health Information Networks, more than 1.5 billion documents shared since launch, roughly 21,000 participating organizations, and 100,000 connections. On information blocking, Posnack noted that developers of certified health IT and health information networks face civil monetary penalties of up to $1 million per violation, while healthcare providers face appropriate disincentives instead. He closed by listing cybersecurity considerations for the future of health IT, including a larger attack surface from increased connectivity, more diverse user types, and a new category of risk: chatbot and agent manipulation.

Key Takeaways

USCDI+ extends the national data standard to support specialized program needs without replacing the core USCDI.
TEFCA has reached meaningful national scale, with over 1.5 billion documents exchanged.
Chatbot and AI agent manipulation is now recognized as a distinct attack surface for health IT systems.

Protecting Health Information: A CFIUS Perspective

Presenter: Tara Vayda, Deputy Director, Office of National Security (HHS)

Vayda’s session addressed the Committee on Foreign Investment in the United States (CFIUS) and its role in reviewing foreign transactions that could affect the security of sensitive health data. Materials pointed attendees to the CFIUS overview and the 2025 Annual Report to Congress for additional detail on the committee’s review process and recent case trends.

Key Takeaways

CFIUS review can apply to foreign investment transactions involving companies that hold sensitive health data.
Organizations engaged in foreign investment or acquisition activity involving health data assets should evaluate CFIUS exposure early in the transaction.

Artificial Intelligence Metrology in Healthcare

Presenter: Ram Sriram, Senior Science Advisor, Information Technology Laboratory (NIST)

Sriram presented on the discipline of metrology, or measurement science, as applied to AI systems, framing accuracy, performance, uncertainty quantification, and risk as core measurable features. He described why AI-enabled devices can be unreliable, distinguishing in-distribution inputs the model was trained to handle from out-of-distribution inputs it was not, and used a cancer biopsy example to show how uncertainty quantification can flag low-confidence predictions for additional human review rather than letting them pass silently. On healthcare chatbots, Sriram noted that intrinsic evaluation metrics, which measure language coherence, are of limited use for healthcare applications, while extrinsic metrics that incorporate user perspective and real-world context are more relevant. For clinical decision support, he outlined performance metrics including hallucination rate, omission rate, groundedness against trusted sources such as PubMed, and guideline adherence, and referenced current vendor deployments such as Epic’s in-basket drafting tool and Oracle Health’s Clinical AI Agent. He closed by stressing that developing shared metrics and standards at the right time supports innovation and that benchmark datasets remain a gap. Sriram separately discussed the importance of agreed-upon metrics for assessing both the accuracy and performance of AI tools, noting that understanding a system’s relative confidence or uncertainty improves trust in its results.

Key Takeaways

Uncertainty quantification allows an AI system to flag when an input falls outside its training distribution rather than returning an overconfident wrong answer.
Hallucination rate, omission rate, groundedness, and guideline adherence are proposed performance metrics for clinical decision support tools.
Standard chatbot evaluation metrics built for general language tasks do not adequately measure healthcare-specific performance.

Medical Device Cybersecurity Roundtable

Participants: Jeffrey Marron (Moderator), Security Engineer, Cybersecurity and Privacy Applications Group (NIST); Justin Post, Cybersecurity Specialist, Center for Devices and Radiological Health (FDA); Dr. Samantha Jacques, Vice President, Corporate Clinical Engineering, McLaren Healthcare; Connor Walsh, Chief Information Security Officer, Americas, Siemens Healthineers; Dr. Kevin Fu, Professor, Northeastern University

Post reviewed FDA’s authority under Section 524B of the Food, Drug, and Cosmetic Act, effective March 2023, which requires manufacturers of internet-connectable “cyber devices” to submit a cybersecurity management plan, a software bill of materials, and documentation supporting reasonable assurance of device security before market authorization. Walsh presented the proposed HIPAA Security Rule requirements for medical devices, which are not yet final, including maintaining a documented device inventory updated at least annually, segmenting medical device and operational technology systems, encrypting ePHI and deploying multifactor authentication subject to specific FDA-authorized exceptions, running vulnerability scans at least every six months, conducting annual penetration testing, and restoring critical systems within 72 hours of an incident. The panel closed on the theme that AI is accelerating vulnerability discovery, illustrated by an example in which AI-assisted analysis identified a flaw in HAWK, a post-quantum signature candidate that was subsequently withdrawn from NIST consideration, underscoring that faster discovery requires equally fast expert verification and coordinated response.

Key Takeaways

The proposed HIPAA Security Rule would impose specific medical device requirements, including a 72-hour restoration target for critical systems, though these remain proposals rather than current law.
Medical device security depends on a shared handoff: manufacturers secure the product, and healthcare organizations secure its operating environment.
AI-assisted vulnerability discovery is accelerating, which raises the importance of coordinated verification before acting on an AI-identified finding.

Cybersecurity Workforce in Healthcare Panel

Participants: Daniel Eliot (Moderator), Project Lead, Applied Cybersecurity Division (NIST); Bezawit Sumner, Chief Information Security Officer, Chesapeake Regional Information System (CRISP); Greg Sieg, Chief Information Security Officer, University of Michigan Regional Health Network; Dr. Charles Sweat, Jr., Healthcare and Public Health Sector Liaison (DHS CISA); Gabriel Oberfield, Member, Bond, Schoeneck, and King

The panel addressed workforce development for healthcare cybersecurity roles, drawing on resources including NIST’s National Initiative for Cybersecurity Education (NICE), the CSF 2.0 Quick-Start Guide for cybersecurity workforce management, the Healthcare Industry Cybersecurity Workforce Guide from the Health Sector Coordinating Council, and CISA’s Healthcare and Public Health cybersecurity resources.

Key Takeaways

NICE and the HSCC Workforce Guide are the primary federal and industry resources for building healthcare cybersecurity talent pipelines.
CISA maintains regional points of contact and a dedicated HPH cybersecurity toolkit for healthcare organizations.

NIST Artificial Intelligence Risk Management Framework

Presenter: Martin Stanley, AI and Cybersecurity Researcher, AI Standards and Guidelines Group (NIST)

Stanley presented the AI Risk Management Framework (AI RMF 1.0), a voluntary resource published in January 2023 for organizations designing, developing, deploying, or using AI systems. He defined an AI system as an engineered system that generates outputs such as predictions, recommendations, or decisions with varying levels of autonomy, and risk as a composite measure of an event’s probability and consequence. The framework centers on a Govern function surrounded by three interacting functions: Map, which identifies risks tied to context; Measure, which assesses identified risks; and Manage, which prioritizes and acts on them. Stanley reviewed the accompanying AI RMF Playbook and three profile types organizations can build: use-case profiles, temporal profiles comparing current and target states, and cross-sectoral profiles for categories such as large language models. He noted planned updates including alignment with international standards, expanded testing and evaluation efforts, and guidance on tradeoffs among trustworthiness characteristics. Stanley explained that managing AI risk can be a moving target, since models are not deterministic and can change over time, sometimes rapidly, or be unexpectedly replaced by a new model, and that NIST is currently revising AI RMF 1.0 under the White House AI Action Plan without a specific release date.

Key Takeaways

The AI RMF Core consists of four functions: Govern, Map, Measure, and Manage, with Govern at the center of the framework.
The framework is voluntary and non-regulatory, but it aligns with related NIST frameworks such as the Cybersecurity Framework.
NIST is actively revising the AI RMF, and organizations should expect the framework to evolve rather than treat the current version as final.

Artificial Intelligence in Healthcare Roundtable

Participants: Dr. Jesse Isaacman-Beck (Moderator context), Director, Division of Artificial Intelligence Policy and Strategy (HHS ONC); Ram Sriram, Senior Science Advisor (NIST); Dr. Samantha Jacques, Vice President, Corporate Clinical Engineering, McLaren Healthcare; Rob Suárez, Vice President and Chief Information Security Officer, CareFirst BlueCross BlueShield

Isaacman-Beck presented HHS priorities for expanding AI use both within the department and across the broader healthcare sector, drawing on themes identified through an HHS Request for Information on AI, including the need for governance and demonstrated evidence of AI trustworthiness and performance. Sriram reiterated the importance of human oversight in healthcare AI applications, while Jacques and Suárez discussed governance and procurement practices for AI vendors from the health system and health plan perspectives, pointing to Health Sector Coordinating Council resources including the Third-Party AI Risk and Supply Chain Transparency Guide. The panel’s discussion reflected a broader conference theme that robust AI governance covering the full life cycle from procurement to deployment is the foundation for using AI tools safely, and that evaluating AI use requires looking at outcomes achieved rather than outputs alone.

Key Takeaways

AI governance must span the full life cycle of a tool, from procurement through deployment and ongoing monitoring.
Third-party AI vendor risk is a growing procurement concern for health plans and health systems alike.
Human oversight remains a stated requirement for healthcare AI applications, not an optional safeguard.

NIST Cybersecurity Framework Profiles, Risk Analysis, and Risk Management

Participants: Nick Heesters, Senior Advisor for Cybersecurity (HHS OCR); Jeff Marron, Security Engineer (NIST); Barbara Cuthill, Co-lead, Cyber AI Profile (NIST); with additional presentations from Bill Fisher, Security Engineer (NCCoE), and Ishika Khemani, Cybersecurity Strategy and Implementation Engineer (MITRE)

Nick Heesters restated the Security Rule’s risk analysis and risk management requirements under 45 CFR § 164.308(a)(1), emphasizing that a compliant risk analysis must be accurate and thorough across all points where ePHI is created, flows through the organization, and leaves the organization, and that risk management must flow directly from the risk analysis findings. Fisher presented the updated NIST Ransomware Risk Management Profile, aligned to CSF 2.0 and published in June 2026, which maps CSF categories and informative references such as NIST SP 800-53 to specific ransomware risk activities, along with a quick-start guide and basic tips for organizations with limited resources. Khemani presented an update on the NIST Cyber AI Profile, released as a preliminary draft (NIST IR 8596) in December 2025 and organized around three focus areas: securing AI systems, conducting AI-enabled cyber defense, and protecting the enterprise from AI-enabled attacks. The Cyber AI Profile is designed to layer AI-specific considerations onto each CSF 2.0 subcategory rather than replace existing frameworks, and NIST has indicated an additional public workshop and a further draft are forthcoming without a confirmed date. The session also touched on the Coalition for Health AI (CHAI) Profile, which aligns healthcare AI priorities such as patient access, diagnostic efficiency, and ethical decision-making with CSF and Privacy Framework outcomes.

Key Takeaways

HIUAA Risk management must be a documented, direct output of the risk analysis, not a separate or disconnected exercise.
The updated Ransomware CSF 2.0 Profile gives organizations a specific control mapping for ransomware preparedness, including for organizations too resource-constrained to complete a full CSF assessment.
The Cyber AI Profile adds AI-specific guidance to the existing Cybersecurity Framework rather than creating a separate framework, and it remains in draft form.

Closeout and Announcements

Presenter: Timothy Noonan, Deputy Director, Health Information Privacy, Data, and Cybersecurity Division (HHS OCR)

Noonan closed the conference by pointing attendees to OCR’s risk analysis and risk management resources, including the Security Risk Assessment Tool, recorded webinars, and ongoing cybersecurity newsletters, and confirmed that session recordings and approved slides would be posted to the NIST event page within two weeks.

Key Takeaways

OCR’s Security Risk Assessment Tool remains available at no cost for organizations building or updating a risk analysis.
Conference recordings and slide decks are the primary way to review sessions not covered live.