HIPAA Continuity and Contingency Planning Requirements

HIPAA (Health Insurance Portability and Accountability Act) Standard requires covered entities to establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information. The Contingency Plan standard includes five implementation specifications

1. Data Backup Plan
Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.

2. Disaster Recovery Plan
Establish (and implement as needed) procedures to restore any loss of data.

3. Emergency Mode Operation Plan
Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.

4. Testing and Revision Procedures
Implement procedures for periodic testing and revision of contingency plans.

5. Applications and Data Criticality Analysis
Assess the relative criticality of specific applications and data in support of other contingency plan components.