Corrective Action Plan Template
Turn an audit finding, incident, or complaint into a plan you can close: the facts, the root cause, specific actions with owners and due dates, how you will check the fix worked, and a sign-off. Edit the example below, then print it or copy it into your compliance file.
Pre-filled with a realistic finding from an internal access audit. Replace each field with your own finding, then print it for the compliance file or copy it into your tracker.
Corrective Action Plan
One plan per finding — attach the audit, incident report, or complaint that triggered it
1.Finding
2.Root cause
3.Corrective actions
4.Monitoring
5.Closure
Closed by (compliance officer or contact)
Date
Keep each CAP with its supporting evidence. HIPAA documentation must be kept for 6 years (45 CFR 164.316(b)(2)). If a finding involves money owed to Medicare or Medicaid, talk to counsel about the 60-day overpayment rule before closing the plan.
What Is a Corrective Action Plan in Healthcare Compliance?
A corrective action plan (CAP) is the written answer to a compliance finding: what went wrong, why, what you will change, who owns each change, and how you will prove it worked. It turns an audit result, an incident, or a complaint into a closed loop instead of a note in a file.
The federal guidance treats this as a core part of any compliance program. Element 7 of OIG's General Compliance Program Guidance is “Responding to Detected Offenses and Developing Corrective Action Initiatives,” and it says programs should investigate concerns, remediate what they find, and analyze the root cause to prevent a recurrence. When HHS settles a HIPAA case, the resolution agreement usually comes with a corrective action plan the practice must carry out under monitoring, so writing your own first is the cheaper version of the same work.
The Five Parts of a CAP That Holds Up
| Part | What to write |
|---|---|
| Finding | The facts, the date found, the source, and the rule or policy involved |
| Root cause | The reason it happened, stated so the fix follows from it |
| Actions | Specific steps, each with one owner and a due date |
| Monitoring | The measure that shows the fix worked, and when you will check it |
| Closure | The result at follow-up, who closed it, and the evidence kept |
The most common weak spot is the root cause. “Staff error” is rarely a root cause; it is a symptom. Ask why the error was possible. In the example above, accounts stayed open because the offboarding checklist never mentioned them, so the fix is a checklist change and a handoff between HR and IT, not a reminder email.
What Should Trigger a Corrective Action Plan?
- A gap in your HIPAA audit or risk analysis.
- A security incident or breach, after the incident report is complete.
- A patient complaint that turns out to be valid.
- A billing or coding audit result, especially one that finds money owed back.
- A hotline report or a request from a payer, OCR, or another agency.
When the finding involves an overpayment
Tracking CAPs Across the Year
Give every plan a number and keep a one-line log: number, finding, owner, due date, status. Review open plans at each compliance committee meeting and put the follow-up checks on your annual compliance work plan.
How long to keep them
HIPAA requires documentation of required actions and activities to be kept for six years from creation or the date last in effect (45 CFR 164.316(b)(2)). Keep the CAP, its evidence, and the closure note together so an auditor can follow the trail.