In order to continue enjoying our site, we ask that you confirm your identity as a human. Thank you very much for your cooperation.
The HIPAA Security Rule 164.308(a)(7)(i) identifies Contingency Plan as a standard under Administrative Safeguards. HIPAA Contingency plans address the “availability” security principle. The availability principle addresses threats related to business disruption –so that authorized individuals have access to vital systems and information when required. HIPAA Contingency Plan: Definition and ScopeContingency planning/ Business Continuity Planning (BCP) is about a coordinated strategy that involves plans, procedures, and technical measures to enable the recovery of systems, operations, and data after a disruption. Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) is the overall process of developing an approved set of arrangements and procedures to ensure your business can respond to a disaster and resume its critical business functions within a required time frame objective. The primary objective is to reduce the level of risk and cost to you and the impact on your staff, customers, and suppliers. A Business Impact Analysis (BIA) is performed at the beginning of disaster recovery and continuity planning to specifically identify the areas that would suffer the greatest financial or operational loss in the event of a disaster or disruption. A key objective is to identify all critical systems that are required for the continuity of the business. Further, a determination of the time it would take to recover such systems in the event of a loss. Definition of Contingency Plan in HIPAA Security regulation:Contingency Plan standard is defined within the Administrative Safeguards section of the HIPAA Security Rule. Its related requirements are also identified as implementation specifications in the Physical Safeguards section of the HIPAA laws as well as the Technical Safeguards section.
Data Backup Plan (Required)164.308(a)(7)(ii)(A)The data backup plan is a required implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule. Disaster Recovery Plan (Required)164.308(a)(7)(ii)(B)The disaster recovery plan is a required implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule. The disaster recovery plan applies to major, usually catastrophic, events that deny access to the normal facility for an extended period. A disaster recovery plan refers to an IT-focused plan designed to restore the operability of the target system, application, or computer facility at an alternate site after an emergency. The disaster recovery plan defines the resources, actions, and data required to reinstate critical business processes that have been damaged because of a disaster. An inventory of all critical data and vital systems must be created as well as documentation of detailed procedures to facilitate the recovery of capabilities at an alternate site. Emergency Mode Operation Plan (Required)164.308(a)(7)(ii)(C)An emergency mode operation plan is a required implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule. The objective of an emergency mode operation plan is to establish (and implement as needed) procedures to enable the continuation of critical business processes for the protection of the security of electronically protected health information while operating in emergency mode. An emergency mode operation plan is part of an overall contingency plan that contains a process enabling an enterprise to continue to operate in the event of fire, vandalism, natural disaster, or system failure. In a manner similar to disaster recovery planning, the budget for and schedule required resources for effective emergency mode operation plan testing. Testing and Revision Procedures (Addressable)164.308(a)(7)(ii)(D)Testing and revision procedures is an addressable implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule. The objective of testing and revision procedures is to implement procedures for periodic testing and revision of contingency plans. These testing and revision procedures are procedures for the processing periodic testing of written contingency plans to discover weaknesses and the subsequent process of revising the documentation, if necessary. These written testing and feedback mechanisms are the key to successful testing. Applications and data criticality analysis is an addressable implementation specification defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA Security Rule. The objective of applications and data criticality analysis is to assess the relative criticality of specific applications and data in support of other contingency plan components. It is an entity’s formal assessment of the sensitivity, vulnerabilities, and security of its programs and information it receives, manipulates, stores, and/or transmits. This procedure begins with an application and data inventory. Contingency operations is an addressable implementation specification defined within the HIPAA Contingency Plan Facility Access Controls standard in the Physical Safeguards section of the HIPAA Security Rule. The objective of contingency operations is to establish (and implement as needed) procedures that allow facility access in support of the restoration of lost data under the disaster recovery plan and emergency mode operation plan in the event of an emergency. Physical security is a critical aspect of disaster and business continuity planning. Administrative controls for physical access to enable contingency operations must be in place so recovery can proceed as defined in plans. Data backup and storage is an addressable implementation specification defined within the Device and Media Controls standard in the HIPAA Contingency Plan Physical Safeguards section of the HIPAA Security Rule. The covered entity must create a retrievable, exact copy of electronically protected health information, when needed, before the movement of equipment. Continual and consistent backup of data is required as one cannot be sure when an organization may experience some disaster that will require access to data that has been backed up to be back in operations. Data may also be lost or corrupted – hence a good data backup plan is important. Emergency access procedure is a required implementation specification defined within the Access Control standard in the Technical Safeguards section of the HIPAA Security Rule. The objective of the emergency access procedure implementation specification is to establish (and implement as needed) procedures for obtaining necessary electronically protected health information during an emergency. Emergency access is a necessary part of access control and will be necessary under emergency conditions, although these may be very different from those used in normal operational circumstances. The National Institute of Standards and Technology (NIST) recommends following seven key steps to address the requirements of contingency planning. These seven key steps for contingency planning are: We can help you in three different ways depending on your need, involvement, time, available resources, and budget. Let us help you with your HIPAA Contingency planning project. Please contact us for more information at or call (515) 865-4591. View HIPAA Security Policies and Procedures |