Domain E: Contingency Planning & Business Continuity
Data backup, disaster recovery, and emergency-mode operations when systems go down.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Data backup plan
45 C.F.R. §164.308(a)(7)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
Disaster recovery plan
45 C.F.R. §164.308(a)(7)(ii)(B) · Source: www.ecfr.gov/current/title-45/section-164.308
Emergency mode operation plan
45 C.F.R. §164.308(a)(7)(ii)(C) · Source: www.ecfr.gov/current/title-45/section-164.308
Contingency plans tested in the past 12 months with documented results
45 C.F.R. §164.308(a)(7)(ii)(D) · Source: www.ecfr.gov/current/title-45/section-164.308
Applications and data criticality analysis
45 C.F.R. §164.308(a)(7)(ii)(E) · Source: www.ecfr.gov/current/title-45/section-164.308
At least one backup copy is kept offline or immutable, and backup logs are reviewed
45 C.F.R. §164.308(a)(7)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
The recovery strategy documents the order and the time targets for restoring systems and data
45 C.F.R. §164.308(a)(7)(ii)(B) · Source: www.ecfr.gov/current/title-45/section-164.308
Contingency testing includes an actual restore of ePHI from backup, with the results recorded
45 C.F.R. §164.308(a)(7)(ii)(D) · Source: www.ecfr.gov/current/title-45/section-164.308
Preventive measures are identified to reduce the likelihood and impact of disruptions
45 C.F.R. §164.308(a)(7)(ii)(E) · Source: www.ecfr.gov/current/title-45/section-164.308