OCR closes each investigation with a narrative: what happened and what the entity changed. Each resolved case is filed under the control domain it teaches, with a program action and the exam domains it touches, in the same chapters as the analytics.
What this means for you
Workforce training is the corrective action OCR records most often: 2,590 resolved cases of 6,578 (39%), while 34% name no specific change.
The control resolved cases teach most is Business associate oversight (31%): Hold vendors to a signed BAA, a security assessment scaled to the data they hold, and a contractual breach-notice window shorter than the rule's 60 days.
Set your entity type and the breach type you most want to prevent, and this shows how many resolved cases match and what organizations like yours changed afterward.
All 6,578 resolved OCR cases with a narrative, submitted 2009 to 2026. These figures do not change with the filters below. Click a control-domain bar to open that domain's chapter.
6,578
Resolved cases with a lesson
Submitted 2009 to 2026
56%
Name a specific change
3,697 of 6,578; 34% name only general safeguards, 10% state no corrective action
39%
Most common corrective action
Workforce training: 2,590 cases
362
Median days to closure
53 cases observed closing since Sep 23, 2026
Control failure mix
Resolved cases by the control domain they teach, of 6,578
Control failure mix by year of submission
Share of each year's resolved cases, five largest domains
Business associate oversight
Email and phishing defense
Device and media encryption
Ransomware resilience and recovery
Paper records and disposal
All other domains
Most common corrective actions
Resolved cases naming each action type, of 6,578
Corrective actions by year of submission
Share of each year's resolved cases naming the five most common actions
Every corrective action type
Corrective action types in resolved OCR cases
Workforce training
2,590
39%
51%
32%
-18 pts
Safeguards not specified
2,220
34%
14%
46%
+31 pts
Policies and procedures
1,249
19%
41%
6%
-35 pts
Workforce sanctions
605
9%
15%
5%
-10 pts
Risk analysis and management
432
7%
16%
1%
-15 pts
Encryption
425
6%
17%
0%
-16 pts
Email security
393
6%
5%
7%
+2 pts
Physical security and disposal
319
5%
10%
2%
-9 pts
Business associate agreements and vendors
285
4%
8%
2%
-6 pts
Access controls and passwords
261
4%
8%
2%
-6 pts
Audits and monitoring
215
3%
7%
1%
-6 pts
Patching and system hardening
126
2%
5%
0%
-4 pts
Multi-factor authentication
91
1%
2%
1%
-1 pts
Time to resolution
Median days from submission to closure, 53 cases Signals observed closing
By year of submission
By breach type
Median days to closure by breach type
Hacking/IT Incident
32
491 days
Unauthorized Access/Disclosure
20
107 days
Theft
1
834 days
Fewer than 5 cases
Chapter 1
Threat landscape now
Is the breach problem growing, and what kind of breach is taking over?
1,172 lessons in this chapterOne complete example below, the rest by title. Search, filters and every lesson in full come with a subscription.
What exploited vulnerabilities look like now
The newest entries in CISA's Known Exploited Vulnerabilities catalog in health IT products. The weakness families behind health IT CVEs, and the control each maps to, are in Chapter 9: Vulnerabilities and vendors.
CVE-2020-11023Oracle Health (Cerner) Healthcare Translationaladded Jan 23, 2025 · health IT
CVE-2023-43208NextGen Healthcare Mirth Connectadded May 20, 2024 · health IT
CVE-2017-0147Siemens Healthineers Acuson, Syngoadded May 24, 2022 · health IT
In its mitigation efforts, the CE removed public access to the storage container and implemented additional monitoring controls to prevent a reoccurrence.
Program action
Centralise logs from ePHI systems and review them on a defined cadence, with alerting on data exfiltration.
HIPAA §164.312(b), 164.308(a)(1)(ii)(D)
CISSP 7CISM 4CISA 4
Full OCR narrative
The covered entity (CE), TELUS Health, Ltd., reported that an internal access control error resulted in a cloud storage container containing protected health information (PHI) being publicly accessible via the internet. According to the breach report, the breach affected approximately 2,641 individuals. The PHI involved dates of birth, other identifiers, and diagnosis/conditions. The CE notified HHS and the affected individuals. In its mitigation efforts, the CE removed public access to the storage container and implemented additional monitoring controls to prevent a reoccurrence. OCR provided technical assistance to the CE regarding the HIPAA Rules and received evidence substantiating the CE’s notifications.
Each resolved OCR case with what the organization changed afterward, the program action it points to and the HIPAA citation, filed by control domain in the same chapters as the analytics.
What changed afterward: corrective actions pulled from OCR's narrative
A program action and HIPAA citation for every lesson
CISSP, CISM and CISA exam-domain tags
Search the narratives; filter by breach type, entity type and location
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
