HIPAA Resolution Agreements and Corrective Action Plans (45 CFR 160.312)
OCR's preferred enforcement disposition: a Resolution Agreement that includes a corrective action plan, payment, and reporting obligations spanning two to three years.
Primary source
45 CFR 160.312 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-C/section-160.312
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 160.312 describes OCR's informal-resolution process. When OCR determines a violation has occurred, it pursues voluntary compliance through informal means. The typical disposition is a Resolution Agreement — a settlement that includes payment of a monetary amount and a Corrective Action Plan (CAP).
A CAP usually runs two to three years and includes: targeted policy updates, workforce training, risk analysis, technical remediations, designated reporting cadence (annual reports to OCR), and an independent monitor in larger cases. Failure to meet CAP milestones can trigger re-opened enforcement.
The Resolution Agreements published on the OCR settlements page are the most useful enforcement guide for practices. Recurring themes: missing or stale risk analyses, missing BAAs, right-of-access delays (OCR's Right of Access Initiative has produced 50+ settlements since 2019), lost or stolen unencrypted laptops, and impermissible disclosures to the press or social media.
Smaller practices are not exempt — many published settlements are in the low to mid five figures involving solo practitioners and small clinics. The administrative load of a CAP often exceeds the monetary settlement.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Enforcement Rule Overview (45 CFR 160 Subpart C-E)The framework for HHS investigation and enforcement of HIPAA violations: complaints, compliance reviews, informal resolution, civil money penalties, and the four-tier culpability structure.
- RegulationHIPAA Civil Money Penalty Tiers (45 CFR 160.404)The four-tier culpability and penalty structure for HIPAA civil money penalties, with statutory caps adjusted annually for inflation.
- RegulationHIPAA Criminal Enforcement (42 USC 1320d-6)Criminal sanctions for knowingly obtaining or disclosing PHI in violation of HIPAA, enforced by the Department of Justice rather than HHS, with three tiers escalating to ten years' imprisonment.
- SRAThe HIPAA Breach Notification Rule, ExplainedThe four-factor risk assessment at 45 CFR 164.402, the 60-day individual notice clock at 164.404, the HHS/media notice paths, and the small-practice annual report under 164.408(c).
- SRAHIPAA Settlements and Civil Money Penalties: A Small-Practice Reading ListHow HHS Office for Civil Rights publishes its enforcement record, the tiered civil money penalty structure at 45 CFR 160.404, and what recent small-practice settlements actually say.
- ComplianceHIPAA Right of Access Requests (45 CFR § 164.524): Respond Inside 30 DaysA 2026 HIPAA right-of-access procedure citing 45 CFR § 164.524, the 30-day window, OCR Right of Access Initiative settlements ($3,500–$240,000 through 2025), and the patient response packet.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.