The purpose of a corrective action plan is to address the underlying issue that led to a HIPAA violation and therefore what the action plan consists of will be relevant to the nature of the violation. Typically, Covered Entities and Business Associates will be required to develop or revise policies to fill gaps in their compliance; and, when new or revised policies affect the functions of the workforce, provide training on the policies.