"[The HHS Office of Civil Rights] will likely be looking for whether organizations have conducted enterprise-wide risk assessments to identify their core technical and procedural vulnerabilities, and whether those assessments then translated into remediation strategies, as well as operational policies and employee training. In particular, HHS OCR is sure to examine the preparedness of organizations to detect, response, and recover from security incidents and data breaches."