HIPAA Glossary · Breach & enforcement
Corrective action plan
Also: CAP
The multi-year, OCR-monitored remediation programme attached to most resolution agreements.
Context
Frequently more expensive in practice than the settlement payment itself. Typical CAP contents: fresh risk analysis within 90–180 days, dated risk management plan, policy updates filed with HHS, workforce training, quarterly attestation reports, two to three years of OCR monitoring. The CAP is why documented programmes before an incident cost far less than programmes rebuilt under OCR's eye.
Related terms
- Resolution agreement — The settlement instrument closing an OCR enforcement action, typically pairing a payment with a corrective action plan.
- Civil money penalty — The formal penalty OCR imposes when a case does not settle, calculated under the four culpability tiers.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.