Requirement
164.308(a)(7) - Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.”
Implementation Specifications
Data Backup Plan (Required) - 164.308(a)(7)(ii)(A)
Requirement: Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.
Disaster Recovery Plan (Required) - 164.308(a)(7)(ii)(B)
Requirement: Establish (and implement as needed) procedures to restore any loss of data.
Emergency Mode Operation Plan (Required) - 164.308(a)(7)(ii)(C)
Requirement: Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.
Testing and Revision Procedures (Addressable) - 164.308(a)(7)(ii)(D)
Requirement: Implement procedures for periodic testing and revision of contingency plans.
Applications and Data Criticality Analysis (Addressable) - 164.308(a)(7)(ii)(E)
Requirement: Assess the relative criticality of specific applications and data in support of other contingency plan components.
Explanation
The purpose of contingency planning is to establish strategies for recovering access to EPHI should the organization experience an emergency or other occurrence, such as a power outage and/or disruption of critical business operations. The goal is to ensure that organizations have their EPHI available when it is needed.
