A risk analysis without treatment plans is a file. Treatment Plans turns each identified risk into a dated piece of work — mitigate, transfer, avoid, or accept with rationale — so the register has forward motion, not just entries.
What it does
- Attaches one treatment plan per risk: strategy, owner, due date, dependencies, evidence of completion.
- Supports the four treatments formally: mitigate, transfer, avoid, accept-with-rationale.
- Converts completed plans into evidence files tied back to the original risk.
- Reports overdue treatments and accepted risks approaching their review date.
How it maps to HIPAA
Treatment plans operationalise §164.308(a)(1)(ii)(B) risk management — the companion requirement to the risk analysis. For addressable specifications, the “equivalent alternative or documented rationale” test under §164.306(d) is captured in a treatment plan, not a free-text comment.
Where it fits
Treatment Plans is a core capability in the Risk Management module and reads from the Risk Register. When plans need delivery help, the HIPAA Implementation service executes them.