OCR closes each investigation with a narrative: what happened and what the entity changed. Each resolved case is filed under the control domain it teaches, with a program action and the exam domains it touches, in the same chapters as the analytics.
What this means for you
Workforce training is the corrective action OCR records most often: 2,601 resolved cases of 6,611 (39%), while 34% name no specific change.
The control resolved cases teach most is Business associate oversight (31%): Hold vendors to a signed BAA, a security assessment scaled to the data they hold, and a contractual breach-notice window shorter than the rule's 60 days.
Set your entity type and the breach type you most want to prevent, and this shows how many resolved cases match and what organizations like yours changed afterward.
All 6,611 resolved OCR cases with a narrative, submitted 2009 to 2026. These figures do not change with the filters below. Click a control-domain bar to open that domain's chapter.
6,611
Resolved cases with a lesson
Submitted 2009 to 2026
56%
Name a specific change
3,708 of 6,611; 34% name only general safeguards, 10% state no corrective action
39%
Most common corrective action
Workforce training: 2,601 cases
430
Median days to closure
74 cases observed closing since Sep 23, 2026
Control failure mix
Resolved cases by the control domain they teach, of 6,611
Each case is filed under one domain, first match wins.
Control failure mix by year of submission
Share of each year's resolved cases, five largest domains
Business associate oversight
Email and phishing defense
Device and media encryption
Ransomware resilience and recovery
Paper records and disposal
All other domains
Years with at least 30 resolved cases.
Most common corrective actions
Resolved cases naming each action type, of 6,611
A case naming several actions counts under each.
Corrective actions by year of submission
Share of each year's resolved cases naming the five most common actions
Lines do not stack: one case can name several actions.
Every corrective action type
Corrective action types in resolved OCR cases
Workforce training
2,601
39%
51%
32%
-18 pts
Safeguards not specified
2,234
34%
14%
46%
+31 pts
Policies and procedures
1,249
19%
41%
6%
-35 pts
Workforce sanctions
606
9%
15%
5%
-10 pts
Risk analysis and management
432
7%
16%
1%
-15 pts
Encryption
425
6%
17%
0%
-16 pts
Email security
393
6%
5%
7%
+2 pts
Physical security and disposal
319
5%
10%
2%
-9 pts
Business associate agreements and vendors
285
4%
8%
2%
-6 pts
Access controls and passwords
261
4%
8%
2%
-6 pts
Time to resolution
Median days from submission to closure, 74 cases Signals observed closing
By year of submission
By breach type
Median days to closure by breach type
Hacking/IT Incident
48
500 days
Unauthorized Access/Disclosure
25
316 days
Theft
1
834 days
Fewer than 5 cases
Measured only for cases Signals saw move from under investigation to the archive, since Sep 23, 2026.
Chapter 1
Threat landscape now
Is the breach problem growing, and what kind of breach is taking over?
1,176 lessons in this chapterOne complete example below, the rest by title. Search, filters and every lesson in full come with a subscription.
What exploited vulnerabilities look like now
The newest entries in CISA's Known Exploited Vulnerabilities catalog in health IT products. The weakness families behind health IT CVEs, and the control each maps to, are in Chapter 9: Vulnerabilities and vendors.
In its mitigation efforts, the CE removed public access to the storage container and implemented additional monitoring controls to prevent a reoccurrence.
Program action
Centralise logs from ePHI systems and review them on a defined cadence, with alerting on data exfiltration.
HIPAA §164.312(b), 164.308(a)(1)(ii)(D)
CISSP 7CISM 4CISA 4
Full OCR narrative
The covered entity (CE), TELUS Health, Ltd., reported that an internal access control error resulted in a cloud storage container containing protected health information (PHI) being publicly accessible via the internet. According to the breach report, the breach affected approximately 2,641 individuals. The PHI involved dates of birth, other identifiers, and diagnosis/conditions. The CE notified HHS and the affected individuals. In its mitigation efforts, the CE removed public access to the storage container and implemented additional monitoring controls to prevent a reoccurrence. OCR provided technical assistance to the CE regarding the HIPAA Rules and received evidence substantiating the CE’s notifications.
Each resolved OCR case with what the organization changed afterward, the program action it points to and the HIPAA citation, filed by control domain in the same chapters as the analytics.
What changed afterward: corrective actions pulled from OCR's narrative
A program action and HIPAA citation for every lesson
CISSP, CISM and CISA exam-domain tags
Search the narratives; filter by breach type, entity type and location
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
