OCR closes each investigation with a narrative: what happened and what the entity changed. Each resolved case is filed under the control domain it teaches, with a program action and the exam domains it touches, in the same chapters as the analytics.
What this means for you
Workforce training is the corrective action OCR records most often: 2,590 resolved cases of 6,578 (39%), while 34% name no specific change.
The control resolved cases teach most is Business associate oversight (31%): Hold vendors to a signed BAA, a security assessment scaled to the data they hold, and a contractual breach-notice window shorter than the rule's 60 days.
Set your entity type and the breach type you most want to prevent, and this shows how many resolved cases match and what organizations like yours changed afterward.
All 6,578 resolved OCR cases with a narrative, submitted 2009 to 2026. These figures do not change with the filters below. Click a control-domain bar to open that domain's chapter.
6,578
Resolved cases with a lesson
Submitted 2009 to 2026
56%
Name a specific change
3,697 of 6,578; 34% name only general safeguards, 10% state no corrective action
39%
Most common corrective action
Workforce training: 2,590 cases
362
Median days to closure
53 cases observed closing since Sep 23, 2026
Control failure mix
Resolved cases by the control domain they teach, of 6,578
Control failure mix by year of submission
Share of each year's resolved cases, five largest domains
Business associate oversight
Email and phishing defense
Device and media encryption
Ransomware resilience and recovery
Paper records and disposal
All other domains
Most common corrective actions
Resolved cases naming each action type, of 6,578
Corrective actions by year of submission
Share of each year's resolved cases naming the five most common actions
Every corrective action type
Corrective action types in resolved OCR cases
Workforce training
2,590
39%
51%
32%
-18 pts
Safeguards not specified
2,220
34%
14%
46%
+31 pts
Policies and procedures
1,249
19%
41%
6%
-35 pts
Workforce sanctions
605
9%
15%
5%
-10 pts
Risk analysis and management
432
7%
16%
1%
-15 pts
Encryption
425
6%
17%
0%
-16 pts
Email security
393
6%
5%
7%
+2 pts
Physical security and disposal
319
5%
10%
2%
-9 pts
Business associate agreements and vendors
285
4%
8%
2%
-6 pts
Access controls and passwords
261
4%
8%
2%
-6 pts
Audits and monitoring
215
3%
7%
1%
-6 pts
Patching and system hardening
126
2%
5%
0%
-4 pts
Multi-factor authentication
91
1%
2%
1%
-1 pts
Time to resolution
Median days from submission to closure, 53 cases Signals observed closing
By year of submission
By breach type
Median days to closure by breach type
Hacking/IT Incident
32
491 days
Unauthorized Access/Disclosure
20
107 days
Theft
1
834 days
Fewer than 5 cases
Chapter 6
Enforcement and the investigation pipeline
How many reports are still under investigation, and how long does OCR take?
Heartland Health CenterNE · Healthcare Provider · 43,728 individuals · submitted Oct 17, 2025
Hacking/IT IncidentNetwork Server
Program action
Read the narrative against your own risk analysis: which safeguard would have stopped this in your environment?
HIPAA §164.306(a)
CISSP 1CISA 1
Full OCR narrative
Heartland Health Center,
OCR Transaction Number: 26-646043
The covered entity (CE), Heartland Health Center, reported that it experienced a hacking incident that affected the protected health information (PHI) of 43,728 individuals. The PHI involved included clinical, demographic and other treatment information. OCR provided the CE with extensive technical assistance regarding the HIPAA Rules.
Each resolved OCR case with what the organization changed afterward, the program action it points to and the HIPAA citation, filed by control domain in the same chapters as the analytics.
What changed afterward: corrective actions pulled from OCR's narrative
A program action and HIPAA citation for every lesson
CISSP, CISM and CISA exam-domain tags
Search the narratives; filter by breach type, entity type and location
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
