For small providers, the HIPAA rules can be confusing. They also are more than 20 years old. Under the HIPAA Right of Access Initiative, the Office of Civil Rights' settlement resulted in a $15,000 resolution amount and required compliance with a two year corrective action plan.