Repeat reporters and recurrence

How often does the same organization report again, and how soon?

193 organisations (5.9% of 3,284) filed more than one report, accounting for 14% of reports; excluding same-incident filings under 30 days apart, the median gap before the next report was 0.8 years. 122 repeat filings came between 30 days and a year after the previous one, inside the window in which corrective actions are usually still being put in place.

What this means for you

6% of organizations here filed more than once: recurrence is common, not exceptional.

Do this next

Close corrective actions with evidence, not intent

This chapter's program actions come with a subscription

Lessons from resolved cases

Start free and set your program

193

Organizations reporting more than once

of 3,284 reporting organizations

5.9%

Share of organizations

filed two or more reports

300

Repeat filings

second and later reports

41%

Within a year (30+ days)

of repeat filings

How soon

Time between one report and the next

Gaps under 30 days usually mean one incident filed separately for several covered entities. Gaps of a month to a year fall inside the window when corrective actions are still being put in place.

Repeat filings by time since the previous report

The most common gap is 30 days to 1 yr (122 filings); 32% of repeat filings come more than a year after the last one.

How this is calculated

Entity names are normalised conservatively (case, punctuation, "&" versus "and", a leading "The" and trailing legal forms such as Inc. or LLC) and grouped with the state, so two organisations with the same name in different states stay separate and near-matches such as "Baptist Health" and "Baptist Medical Center" are never merged. This undercounts repeats where a name changed. Gaps are measured between consecutive submissions; gaps under 30 days often reflect one incident filed separately for several covered entities rather than a second breach.

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 8: Repeat reporters and recurrence

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.

The most frequent reporters
What this means for your program: 3 key points
3 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Close corrective actions with evidence, not intent”
Exam angle for 5 CISSP, CISM and CISA domains, with a study prompt
214 lessons from resolved OCR cases filed under this chapter

Start free Or subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works