Enforcement and the investigation pipeline

How many reports are still under investigation, and how long does OCR take?

753 of the 3,584 reports in this view (21%) are still listed as under investigation. The median open case was submitted 9 months ago and 38% have been open more than a year. Of 53 closures observed since 2026-09-23, the median case closed 12 months after submission.

What this means for you

38% of open cases are more than a year old, so budget for a long tail of regulator contact after any breach.

Do this next

Keep an investigation-ready evidence file

This chapter's program actions come with a subscription

Lessons from resolved cases

Start free and set your program

753

Under investigation

reports in OCR's open list

9 mo

Median age of an open case

since submission

38%

Open more than a year

287 cases

362

Median days to close

53 closures observed

The pipeline

How long investigations stay open

Every report starts on OCR's “under investigation” list and moves to the archive when the case closes. Click a year to open that year's reports.

Reports by submission year: resolved and still under investigation

753 reports are still open; the oldest were submitted in 2023.

Table view


2022	718	0
2023	743	2
2024	704	37
2025	479	328
2026	187	386

How this is calculated

Status is OCR's own: reports on the “Under Investigation” list are open; reports on the archive list are resolved. Counts are by the year OCR received the report.

Open investigations by time since submission

753 matching reports are still under investigation; the median open case was submitted 9 months ago and 38% have been open more than a year. Of 53 closures observed since 2026-09-23, the median case closed 12 months after submission.

How this is calculated

Open cases are the reports in OCR's "Under Investigation" list; age is today minus the submission date. Time to close is measured only for cases this site has watched move from that list to the archive, from submission to the day the daily ingest first saw the move, so it is accurate to a day. That history starts with the change log (2026-09-23) and a median is shown once 10 closures have been observed. Cases already archived before the log began carry no closing date, so they cannot be used.

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 6: Enforcement and the investigation pipeline

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.

Open investigations by state
From breach report to resolution
What this means for your program: 3 key points
3 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Keep an investigation-ready evidence file”
Exam angle for 4 CISSP, CISM and CISA domains, with a study prompt
43 lessons from resolved OCR cases filed under this chapter

Start free Or subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works