Primary fiber cut outside the hospital
SD-WAN fails to cellular secondary within minutes; cloud EHR and e-prescribe continue while nonessential updates are throttled — CP-8 meets the availability RTO.
Telecommunications Services
High Risk
Moderate
Medium Cost
CP-8 requires establishing alternate telecommunications services including necessary agreements to permit resumption of system operations for essential missions/business functions within organization-defined time periods when the primary telecommunications capabilities are unavailable. Healthcare depends on circuits for cloud EHR, HIE, e-prescribing, claims, telehealth, and voice — a single ISP outage can halt care coordination as surely as a server failure.
Control Objective
Provide alternate network and voice telecommunications paths so essential ePHI-dependent clinical and business functions continue within defined timeframes when primary circuits fail.
Implementation Guidance
- Inventory critical telecom dependencies: primary ISP, MPLS, SIP trunks, cellular backup, vendor VPNs, and cloud on-ramps.
- Design alternate paths with diversity (second carrier, cellular/LTE/5G failover, satellite where justified) — avoid shared last-mile where possible.
- Execute agreements covering provisioning SLAs, failover support, and priority restoration if offered.
- Automate or document failover for firewall/SD-WAN; test failovers under CP-4.
- Prioritize bandwidth for EHR, identity, e-prescribing, and telehealth during degraded mode.
- Include voice/patient-access lines in the alternate telecom plan — not only data.
- Coordinate with CP-7 so the alternate processing site has diverse telecom too.
- Monitor circuit health and alert before clinical users flood the help desk.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Telehealth clinic loses SIP trunk
Alternate carrier trunk and softphone runbook keep nurse triage lines open during a regional VoIP outage.
Shared conduit surprise
'Two ISPs' shared the same pole. After an outage, CP-8 remediation requires true path diversity documentation from carriers.
Best Practices
- Carrier and path diversity, not duplicate circuits on one fiber.
- Tested automated failover.
- Written priority for clinical traffic in degraded mode.
- Include voice and fax-to-ehr paths where still used.
- Align alternate telecom with CP-7 site connectivity.
- Monitor and alert on primary path loss.
Common Gaps & Violations
- Single ISP with no backup.
- Backup modem never tested; credentials expired.
- Dual circuits in the same physical path.
- Data failover exists; phones die.
- No agreement for expedited restoration.
Required Documentation
- Telecom dependency inventory
- Alternate service design and diversity notes
- Carrier agreements / SLAs
- Failover runbooks
- Failover test records
How to Test & Validate
- Review circuit inventory for single points of failure.
- Execute a planned primary-path failure and time recovery.
- Verify EHR/telehealth usability on the alternate path.
- Confirm voice failover where in scope.
- Validate carrier diversity claims where possible.
Audit Considerations
Availability findings often start with "the internet was down." CP-8 evidence shows intentional alternate telecom with tests — especially for cloud-first EHR environments.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(7) Contingency Plan — emergencies include loss of communications needed to operate systems with ePHI.
- 164.308(a)(7)(ii)(C) Emergency Mode Operation — continue critical processes; telecom is often the enabling control.
- 164.312(a)(1) Access Control / availability of ePHI — users cannot access ePHI systems without network paths.
- 164.308(a)(1) Risk Management — ISP and voice outages are foreseeable risks requiring mitigation.
Compliance Tips
- Put SD-WAN/cellular failover test on the quarterly maintenance calendar.
- Ask carriers in writing whether last-mile paths are diverse.
- Publish a one-page 'EHR unreachable' network checklist for clinic managers.
Frequently Asked Questions
Is a consumer LTE hotspot enough for CP-8?
It can be part of a small-clinic design if capacity, security (VPN), and tested failover meet your RTOs — document limits honestly.
How does CP-8 relate to CP-7?
CP-7 is where processing resumes; CP-8 ensures you can reach users, cloud services, and partners over alternate telecom.
Do we need alternate telecom if the EHR is SaaS?
Especially then — local connectivity loss blocks SaaS EHR, telehealth, and clearinghouse access.
References & Resources
- NIST SP 800-53 Rev. 5 — CP-8
- NIST SP 800-34 Contingency Planning Guide
- Related controls: CP-2, CP-7, CP-4, SC-7
Related Guidelines
Related controls that commonly accompany CP-8.
Need Help Implementing CP-8?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.