Contingency Plan
Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain ePHI.
Implementation Guidance
• Data backup plan with regular backups and testing
• Disaster recovery plan with recovery time objectives
• Emergency mode operation plan for critical functions
• Testing and revision procedures for all plans
• Applications and data criticality analysis
• Emergency access procedures
• Communication plans for emergencies
Key components:
- Data backup and recovery procedures
- Disaster recovery planning
- Emergency mode operations
- Business continuity planning
- Regular testing and updating of plans
- Critical system identification
Required Documentation
• Data backup plan and procedures
• Disaster recovery plan
• Emergency mode operation plan
• Testing and revision procedures
• Applications and data criticality analysis
• Emergency access procedures
• Communication plans
Best Practices
• Implement regular data backup procedures
• Create detailed disaster recovery plans
• Establish emergency mode operations
• Regular testing and updating of plans
• Document all critical systems and applications
• Establish clear communication procedures
• Coordinate with external service providers
Common Violations
• Inadequate data backup procedures
• Insufficient disaster recovery planning
• No emergency mode operation plan
• Failure to test contingency plans regularly
• Inadequate documentation of critical systems
• Insufficient emergency communication procedures
Testing Procedures
• Test data backup and recovery procedures
• Verify disaster recovery capabilities
• Test emergency mode operations
• Review testing and revision procedures
• Verify critical system documentation
• Test emergency communication procedures
• Conduct tabletop exercises
Implementation Resources
Download expert-developed templates and checklists to implement this control:
Quick Facts
Related Controls
Explore other controls in the Administrative Safeguards category.
Workforce Security
Implement policies and procedures to ensure that all members of the workforce have appropriate access to electronic protected health information (ePHI...
Security Incident Procedures
Implement policies and procedures to address security incidents....
Information Access Management
Implement policies and procedures for authorizing access to ePHI that are consistent with the applicable requirements of the Security Rule....
Need Help Implementing This Control?
Our certified HIPAA experts can help you implement this control correctly and efficiently.