HIPAA Contingency Plan: Disaster Recovery and Business Continuity Plan

What is HIPAA Contingency Plan?

A HIPAA Contingency Plan is a set of policies and procedures designed to ensure that protected health information (PHI) is accessible, secure, and usable during and after an emergency or disaster. This plan is a requirement under the Health Insurance Portability and Accountability Act (HIPAA) and is crucial for maintaining the confidentiality, integrity, and availability of electronic PHI (ePHI). Here are the main components and purposes of a HIPAA Contingency Plan:

  1. Data Backup Plan

A data backup plan involves creating and maintaining retrievable, exact copies of ePHI. This ensures that data can be restored in case of data loss due to system failures, cyberattacks, or other emergencies.

  1. Disaster Recovery Plan

A disaster recovery plan outlines the processes and procedures for restoring any loss of data and system functionality after a disaster. This includes steps to recover ePHI and ensure that critical systems and applications are operational as quickly as possible.

  1. Emergency Mode Operation Plan

This plan ensures the continuation of critical business processes that protect the security of ePHI while operating in emergency mode. It involves procedures to keep essential functions running during and immediately after an emergency.

  1. Testing and Revision Procedures

Regular testing and revision of the contingency plan are essential to ensure its effectiveness. This involves conducting periodic drills and simulations to identify potential weaknesses and making necessary updates to the plan.

  1. Application and Data Criticality Analysis

This analysis identifies the most critical applications and data that are essential for healthcare operations. It helps prioritize the recovery efforts to ensure that the most important systems and data are restored first.

.

Buy HIPAA Business Continuity Planning Templates

.

Purposes of a HIPAA Contingency Plan

  1. Ensuring Compliance

Compliance with HIPAA regulations is mandatory for covered entities and their business associates. A comprehensive contingency plan helps organizations meet these regulatory requirements and avoid penalties.

  1. Protecting Patient Information

The primary goal of the contingency plan is to protect the confidentiality, integrity, and availability of ePHI during emergencies. This includes preventing unauthorized access, ensuring data accuracy, and maintaining availability.

  1. Maintaining Continuity of Care

During and after a disaster, it is essential to maintain the continuity of patient care. The contingency plan ensures that critical healthcare operations can continue, minimizing disruptions to patient services.

  1. Minimizing Operational Downtime

Effective contingency planning helps minimize downtime by ensuring that data and systems can be quickly restored. This reduces the impact of emergencies on healthcare operations and ensures that services can resume swiftly.

  1. Enhancing Organizational Resilience

A well-developed contingency plan enhances the overall resilience of the healthcare organization. It prepares the organization to handle various emergencies, from natural disasters to cyberattacks, ensuring that it can recover and continue operations.

  1. Building Trust and Confidence

Patients and stakeholders expect healthcare organizations to be prepared for emergencies. A robust contingency plan builds trust and confidence by demonstrating the organization’s commitment to protecting sensitive information and maintaining services.

  1. Supporting Risk Management

The contingency plan is an integral part of the organization’s risk management strategy. It helps identify potential risks and provides a framework for addressing them, reducing the likelihood and impact of emergencies.

Definition of Contingency Plan in HIPAA Security Regulation

Contingency Plan standard is defined within the Administrative Safeguards section of the HIPAA Security Rule. HIPAA Contingency plan-related requirements are also identified as implementation specifications in the Physical Safeguards section of the HIPAA laws as well as the Technical Safeguards section.

Item

HIPAA Citation

HIPAA Security Rule Standard Implementation Specification

Implementation

ADMINISTRATIVE SAFEGUARDS
  164.308(a)(7)(i) Contingency Plan  
  164.308(a)(1)(ii)(A) Data Backup Plan

Required
  164.308(a)(1)(ii)(B) Disaster Recovery Plan

Required
  164.308(a)(1)(ii)(C) Emergency Mode Operation Plan

Required
  164.308(a)(1)(ii)(D) Testing and Revision Procedures

Addressable
  164.308(a)(1)(ii)(E) Applications and Data Criticality Analysis

Addressable

PHYSICAL SAFEGUARDS
  164.310(a)(1) Facility Access Controls
–
  164.310(a)(2)(i) Contingency Operations

Addressable
  164.310(d)(1) Device and Media Controls

–
  164.310(d)(2)(iv) Data Backup and Storage

Addressable

TECHNICAL SAFEGUARDS
  164.312(a)(1) Access Control

–
  164.312(a)(2)(ii) Emergency Access Procedure

Required

Data Backup Plan (Required)164.308(a)(7)(ii)(A)

The data backup plan is a required implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule.

The objective of the data backup plan is to establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information. The data backup plan is a documented and routinely updated plan to create and maintain, for a specific period of time, retrievable exact copies of information. Successful data backup and restores are sometimes dependent on business processes and “batch” activities.

Disaster Recovery Plan (Required)164.308(a)(7)(ii)(B)

The disaster recovery plan is a required implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule.
The objective of a disaster recovery plan is to establish (and implement as needed) procedures to restore any loss of data. A disaster recovery plan is part of an overall contingency plan that contains a process enabling an enterprise to restore any loss of data in the event of fire, vandalism, natural disaster, or system failure.
The disaster recovery plan applies to major, usually catastrophic, events that deny access to the normal facility for an extended period. A disaster recovery plan refers to an IT-focused plan designed to restore the operability of the target system, application, or computer facility at an alternate site after an emergency.

The disaster recovery plan defines the resources, actions, and data required to reinstate critical business processes that have been damaged because of a disaster. An inventory of all critical data and vital systems must be created as well as documentation of detailed procedures to facilitate the recovery of capabilities at an alternate site.

Emergency Mode Operation Plan (Required)164.308(a)(7)(ii)(C)

An emergency mode operation plan is a required implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule.
The objective of an emergency mode operation plan is to establish (and implement as needed) procedures to enable the continuation of critical business processes for the protection of the security of electronic protected health information while operating in emergency mode. An emergency mode operation plan is part of an overall contingency plan that contains a process enabling an enterprise to continue to operate in the event of fire, vandalism, natural disaster, or system failure. In a manner similar to disaster recovery planning, budget for and schedule required resources for effective emergency mode operation plan testing.

Testing and Revision Procedures (Addressable)164.308(a)(7)(ii)(D)

Testing and revision procedures is an addressable implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule.
The objective of testing and revision procedures is to implement procedures for periodic testing and revision of contingency plans. These testing and revision procedures are procedures for the processing periodic testing of written contingency plans to discover weaknesses and the subsequent process of revising the documentation, if necessary. These written testing and feedback mechanisms are the key to successful testing.

Applications and Data Criticality Analysis (Addressable) 164.308(a)(7)(ii)(E)

Applications and data criticality analysis is an addressable implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule.
The objective of applications and data criticality analysis is to assess the relative criticality of specific applications and data in support of other contingency plan components. It is an entity’s formal assessment of the sensitivity, vulnerabilities, and security of its programs and information it receives, manipulates, stores, and/or transmits. This procedure begins with an application and data inventory.

Contingency Operations (Addressable) 164.310(a)(2)(i)

Contingency operations is an addressable implementation specification defined within the Facility Access Controls standard in the Physical Safeguards section of the HIPAA Security Rule.
The objective of contingency operations is to establish (and implement as needed) procedures that allow facility access in support of the restoration of lost data under the disaster recovery plan and emergency mode operation plan in the event of an emergency.
Physical security is a critical aspect of disaster and business continuity planning. Administrative controls for physical access to enable contingency operations must be in place so recovery can proceed as defined in plans.

Data Backup and Storage (Addressable) 164.310(d)(2)(iv)

Data backup and storage is an addressable implementation specification defined within the Device and Media Controls standard in the Physical Safeguards section of the HIPAA Security Rule.
The covered entity must create a retrievable, exact copy of electronic protected health information, when needed, before the movement of equipment. Continual and consistent backup of data is required as one cannot be sure when an organization may experience some disaster that will require access to data that has been backed up to be back in operations. Data may also be lost or corrupted – hence a good data backup plan is important.

Emergency Access Procedure (Required) 164.312(a)(2)(ii)

Emergency access procedure is a required implementation specification defined within the Access Control standard in the Technical Safeguards section of the HIPAA Security Rule.
The objective of the emergency access procedure implementation specification is to establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency. Emergency access is a necessary part of access control and will be necessary under emergency conditions, although these may be very different from those used in normal operational circumstances.

You can buy our templates to meet your HIPAA business continuity requirement if you want to jump start the project on your own. You can hire us to help you with sections where you may need help.

Contingency Planning: 7 Steps

The National Institute of Standards and Technology (NIST) recommends following seven key steps to address the requirements of contingency planning. These seven key steps for contingency planning are:
1. Develop the contingency planning policy statement. A formal department or agency policy provides the authority and guidance necessary to develop an effective contingency plan.
2. Conduct the business impact analysis (BIA). The BIA helps to identify and prioritize critical IT systems and components. A template for developing the BIA is also provided to assist the user.
3. Identify preventive controls. Measures taken to reduce the effects of system disruptions can increase system availability and reduce contingency life cycle costs.
4. Develop recovery strategies. Thorough recovery strategies ensure that the system may be recovered quickly and effectively following a disruption.
5. Develop an IT contingency plan. The contingency plan should contain detailed guidance and procedures for restoring a damaged system.
6. Plan testing, training, and exercises. Testing the plan identifies planning gaps, whereas training prepares recovery personnel for plan activation; both activities improve plan effectiveness and overall agency preparedness.
7. Plan maintenance. The plan should be a living document that is updated regularly to remain current with system enhancements.

How can Supremus Group help your compliance Efforts?

We can help you in three different ways depending on your need, involvement, time, available resources, and budget.

OPTION 1: If you are in a hurry to complete the HIPAA Security Contingency Plan and you don’t have internal resources to completely devote to this project then we can independently complete the project for you. The only involvement required will be providing information about your infrastructure, policies, processes, and a current contingency plan if any.
OPTION 2: If you have internal staff members who can completely devote their time to this project but don’t know the methodology, we will provide a project manager to work with your team and help to complete the Contingency plan document.
OPTION 3: If you have all the necessary resources for Business Continuity Planning and BIA project but need to save time on documentation, you can use our HIPAA Contingency Plan Template Suite. Many IT Security consulting companies, HIPAA consultants, and hospitals are using our HIPAA Contingency plan templates in their projects. 

Remember, the goal of a HIPAA Contingency Plan is to minimize the impact of disruptions on the confidentiality, integrity, and availability of healthcare information. Regularly review and update the plan to address evolving threats and changes in the healthcare environment.

Let us help you with your Contingency planning project.

Please contact us for more information at Bob@HIPAAcertification.net or call (515) 865-4591.

View HIPAA Security Policies and Procedures