Why Remediation Plans Matter

Identifying gaps is only half the work. HIPAA requires not just that you find problems, but that you document your plan to fix them and follow through. A remediation plan is your formal commitment to address a specific gap — it records what you are going to do, who is responsible, and when it will be done.

In an OCR audit or investigation, your remediation plans are among the most important documents you can produce. They demonstrate that your organization takes compliance seriously, acts on identified risks, and maintains an ongoing improvement program. Organizations with no remediation plans — even ones with good controls — look reactive and unprepared.

Creating a Remediation Plan in the Portal

There are two ways to create a plan:

From the Gap Analysis Report

This is the recommended approach. In your Gap Analysis report, click any gap row to expand it, then click Create Remediation Plan. The portal pre-fills the plan with the gap description and recommended actions, saving you time. Review and customize the pre-filled content, then complete the remaining fields.

From the Remediation Plans Section

Navigate to Remediation Plans in the left menu and click New Plan. This approach is useful for creating plans for process improvements that do not directly correspond to a gap entry.

Completing a Plan

Each remediation plan requires the following fields:

Title — a short, descriptive name (e.g., "Implement ePHI Encryption on All Workstations")
Description — detailed description of the gap being addressed and the planned fix
Owner — the staff member responsible for completing this plan (select from your employee list)
Target Completion Date — a realistic deadline based on effort and priority
Priority — Critical, High, Medium, or Low (should match the gap severity)
Action Steps — a checklist of specific tasks needed to complete the plan

Tip: Break large remediation efforts into multiple plans rather than one sprawling plan. "Implement full workforce training program" is better handled as separate plans for: creating training content, scheduling sessions, tracking completion, and documenting results.

Setting Realistic Timelines

Use these guidelines for setting target dates based on gap severity:

Critical gaps: 30 days or less
High gaps: 30–60 days
Medium gaps: 60–90 days
Low gaps: 90–180 days

If a remediation requires vendor procurement, budget approval, or construction, set a realistic date and document the dependency in the description field. OCR understands that some fixes take time — what they look for is a documented plan with genuine progress.

Tracking Progress

As work progresses, update your plan's status: Open, In Progress, Blocked, or Completed. Add notes to document milestones, challenges, and decisions made along the way. When all action steps are checked and the plan is complete, mark it Completed and record the completion date.

Important: Never delete a remediation plan, even after it is completed. Completed plans are part of your compliance audit trail. They show OCR that you identified a problem and fixed it — that is exactly the evidence you want to be able to produce.