Compliance & Legal
Corrective Action Plan (CAP)
A remediation plan an organization agrees to after an OCR HIPAA enforcement action.
A Corrective Action Plan (CAP) is a structured remediation agreement that an organization enters into with the Office for Civil Rights following a HIPAA violation, typically alongside a monetary settlement.
A CAP specifies the corrective steps, timelines, policy updates, and reporting obligations the organization must complete, often under OCR monitoring for a period of years. CAPs are a common outcome of breach investigations and a public signal of what remediation regulators expect. How a CAP fits into enforcement is in HIPAA violation fines and penalties.