HIPAA Rules on Contingency Planning
The HIPAA rules on contingency planning are that covered entities must prepare a contingency plan for each type of foreseeable disaster that includes data backup, emergency mode operations, and disaster recovery. The HIPAA rules on contingency planning also require plans to be tested and assessed for effectiveness – which, for healthcare organizations, is also a condition of participation in Medicare.
Contingency plans should cover all types of emergencies, such as natural disasters, fires, vandalism, system failures, cyberattacks, and ransomware incidents. The steps that must be taken for each scenario could well be different, especially in the case of cyberattacks vs. natural disasters. The plan should incorporate procedures to follow for specific types of disasters.
Contingency planning is not simply a best practice. It is a requirement of the HIPAA Security Rule. Contingency planning should not be considered a onetime checkbox item necessary for HIPAA compliance. It should be an ongoing process with plans regularly checked, updated, and tested to ensure any deficiencies are identified and addressed.
What are the HIPAA Rules on Contingency Planning?
HIPAA Rules on contingency planning are concerned with ensuring healthcare organizations return to normal operations as quickly as possible and the confidentiality, integrity, and availability of PHI is safeguarded.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
HIPAA Rules on contingency planning can be found in the Security Rule administrative safeguards -45 CFR § 164.308(a)(7)(ii)(A-E).
- Develop and Implement a Data Backup Plan – 308(a)(7)(ii)(A)
- Develop a Disaster Recovery Plan – 308(a)(7)(ii)(B)
- Develop and Emergency Mode Operation Plan – 308(a)(7)(ii)(C)
- Develop and Implement Procedures for Testing and Revision of Contingency Plans – 308(a)(7)(ii)(D)
- Perform an Application and Data Criticality Analysis – 308(a)(7)(ii)(E)
A data backup plan ensures that when disaster strikes, PHI is not lost or destroyed. A viable copy of all ePHI must be created that allows exact copies of ePHI to be restored, which includes all forms of ePHI such as medical records, diagnostic images, test results, case management information, and accounting systems. It is a good best practice to adopt a 3-2-1 approach for backups: Create three copies of data, store them on at least two different media, and have one copy stored securely offsite. Backups must also be tested to ensure the recovery of data is possible.
A disaster recovery plan should establish the procedures that must be followed to restore access to data, including how files should be restored from backups. A copy of the plan should be readily available and stored in more than one location.
The emergency mode operation plan must ensure critical business processes continue to maintain the security of ePHI when operating in emergency mode, for example when there is a technical failure or power outage.
All elements of the contingency plan must be regularly tested and revised as necessary. OCR recommends conducting scenario-based walkthroughs and live tests of the complete plan.
Covered entities should “assess the relative criticality of specific applications and data in support of other contingency plan components.” All software applications that are used to store, maintain, or transmit ePHI must be assessed to determine the level of criticality to business functions as it will be necessary to prioritize each when data is restored.
Summary of Key Elements of Contingency Planning
OCR has provided a summary of the key elements of contingency planning:
- The primary goal is to maintain critical operations and minimize loss.
- Define time periods – What must be done during the first hour, day, or week?
- Establish Plan Activation – What event(s) will cause the activation of the contingency plan? Who has the authority to activate the contingency plan?
- Ensure the contingency plan can be understood by all types of employees.
- Communicate and share the plan and roles and responsibilities with the organization.
- Establish a testing schedule for the plan to identify gaps.
- Ensure updates for plan effectiveness and increase organizational awareness.
- Review the plan on a regular basis and provide additional training when there are technical, operational, environmental, or personnel changes in the organization.
