The Office of Civil Rights could have initiated follow-up after discovering security flaws, but "rarely initiated these reviews when it identified serious compliance issues," according to the HHS inspector general's audit program review.