InfoSec Signals™
Sign InStart Free

Lessons learned

OCR closes each investigation with a narrative: what happened and what the entity changed. Each resolved case is filed under the control domain it teaches, with a program action and the exam domains it touches, in the same chapters as the analytics.

What this means for you

Workforce training is the corrective action OCR records most often: 2,590 resolved cases of 6,578 (39%), while 34% name no specific change.

The control resolved cases teach most is Business associate oversight (31%): Hold vendors to a signed BAA, a security assessment scaled to the data they hold, and a contractual breach-notice window shorter than the rule's 60 days.

Do this next

Latest case: Partnership HealthPlan of California

Submitted Sep 4, 2026; assign it as a tabletop or training case

Lessons that apply to you

Set your entity type and the breach type you most want to prevent, and this shows how many resolved cases match and what organizations like yours changed afterward.

Start free and set your program

Lessons by the numbers

All 6,578 resolved OCR cases with a narrative, submitted 2009 to 2026. These figures do not change with the filters below. Click a control-domain bar to open that domain's chapter.

6,578
Resolved cases with a lesson
Submitted 2009 to 2026
56%
Name a specific change
3,697 of 6,578; 34% name only general safeguards, 10% state no corrective action
39%
Most common corrective action
Workforce training: 2,590 cases
426
Median days to closure
58 cases observed closing since Sep 23, 2026

Control failure mix

Resolved cases by the control domain they teach, of 6,578

Each case is filed under one domain, first match wins.

Control failure mix by year of submission

Share of each year's resolved cases, five largest domains

  • Business associate oversight
  • Email and phishing defense
  • Device and media encryption
  • Ransomware resilience and recovery
  • Paper records and disposal
  • All other domains
Years with at least 30 resolved cases.

Most common corrective actions

Resolved cases naming each action type, of 6,578

A case naming several actions counts under each.

Corrective actions by year of submission

Share of each year's resolved cases naming the five most common actions

Lines do not stack: one case can name several actions.

Every corrective action type

Corrective action types in resolved OCR cases
Workforce training2,59039%51%32%-18 pts
Safeguards not specified2,22034%14%46%+31 pts
Policies and procedures1,24919%41%6%-35 pts
Workforce sanctions6059%15%5%-10 pts
Risk analysis and management4327%16%1%-15 pts
Encryption4256%17%0%-16 pts
Email security3936%5%7%+2 pts
Physical security and disposal3195%10%2%-9 pts
Business associate agreements and vendors2854%8%2%-6 pts
Access controls and passwords2614%8%2%-6 pts
Audits and monitoring2153%7%1%-6 pts
Patching and system hardening1262%5%0%-4 pts
Multi-factor authentication911%2%1%-1 pts

Time to resolution

Median days from submission to closure, 58 cases Signals observed closing

By year of submission

By breach type

Median days to closure by breach type
Hacking/IT Incident37519 days
Unauthorized Access/Disclosure20107 days
Theft1834 daysFewer than 5 cases
Measured only for cases Signals saw move from under investigation to the archive, since Sep 23, 2026.

Chapter 4

Scale and impact

How large is a typical breach, and what separates the mega-breach from the rest?

Read the analytics chapter

247 lessons in this chapterOne complete example below, the rest by title. Search, filters and every lesson in full come with a subscription.

Example lessonIncident response and notificationChapter 4: Scale and impact →
Lumexa ImagingNC · Healthcare Provider · 5,830,949 individuals · submitted May 15, 2026
Hacking/IT IncidentNetwork Server

Program action

Rehearse notification at scale: HHS, individuals and media, with mailing and call-centre support contracted in advance.

HIPAA §164.404-164.408, 164.308(a)(6)

CISSP 7CISM 4CISA 4

Full OCR narrative

The covered entity (CE), Lumexa Imaging, reported that it was notified by its business associate (BA) that it experienced a breach involving access to its network by an unauthorized threat actor. According to the breach report, the breach affected approximately 5,830,949 individuals. The protected health information involved demographic, financial, and treatment information. The CE notified HHS, the media, and the affected individuals. OCR provided technical assistance to the CE regarding the HIPAA Rules.

More lessons in this chapter (titles only)

and 238 more in this chapter

Subscriber feature · $5 a month or $50 a year

Read all 6,589 lessons in full

Each resolved OCR case with what the organization changed afterward, the program action it points to and the HIPAA citation, filed by control domain in the same chapters as the analytics.
  • What changed afterward: corrective actions pulled from OCR's narrative
  • A program action and HIPAA citation for every lesson
  • CISSP, CISM and CISA exam-domain tags
  • Search the narratives; filter by breach type, entity type and location
Start freeOr subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.