OCR Settlement Lessons – No Risk Assessment Exposes Provider to Liability Failure to conduct a risk assessment before a hacking incident occurred resulted in a $400,000 settlement between OCR and a Federally Qualified Health Clinic.  The FQHC filed a breach report upon learning that its employee...