HIPAA Glossary · Breach & enforcement
Resolution agreement
The settlement instrument closing an OCR enforcement action, typically pairing a payment with a corrective action plan.
Context
The resolution agreement is the public artefact of most OCR enforcement outcomes — the HHS resolution agreements page lists them. Payments vary from the tens of thousands (Right of Access cases) to the millions (ransomware, breach, and Risk Analysis Initiative cases). The corrective action plan attached to the agreement typically runs for two to three years.
Related terms
- Corrective action plan — The multi-year, OCR-monitored remediation programme attached to most resolution agreements.
- Civil money penalty — The formal penalty OCR imposes when a case does not settle, calculated under the four culpability tiers.
- OCR — The HHS office that administers and enforces the HIPAA rules through investigations, audits, penalties, and resolution agreements.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.