OCR Fines Florida Physicians Group $500,000 for HIPAA Failures: "To make matters worse, while ACH was founded in 2005, the company failed to conduct a risk analysis until March 4, 2014. Further, they never implemented security measures or any other written HIPAA policies or procedures prior to 2014."