"OCR should [1] enter small-breach information into its case-tracking system or a searchable database linked to it; [2] maintain complete documentation of corrective action; [3] develop an efficient method in its case-tracking system to search for and track covered entities that reported prior breaches; [4] develop a policy requiring OCR staff to check whether covered entities reported prior breaches; and [5] continue to expand outreach and education efforts to covered entities."  MORE >>