Section § 164.308(a)(7)Contingency plan

What it says

(7)(i) Standard: Contingency plan. Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.

(ii) Implementation specifications:

(A) Data backup plan (Required). Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.

(B) Disaster recovery plan (Required). Establish (and implement as needed) procedures to restore any loss of data.

(C) Emergency mode operation plan (Required). Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.

(D) Testing and revision procedures (Addressable). Implement procedures for periodic testing and revision of contingency plans.

(E) Applications and data criticality analysis (Addressable). Assess the relative criticality of specific applications and data in support of other contingency plan components.

HIPAA, the United States rules protecting health information, § 164.308(a)(7)

What is in the packs for this

Each one helps with this requirement.

• XLSExcel

  Security Rule Safeguard Register

  in HIPAA Security Rule ReadinessIts Framework References cite this section. Lists the 22 Security Rule standards and their 41 implementation specifications in plain words, required or addressable, with an owner and the evidence to keep.
• DOCWord

  Business Continuity & ICT Resilience Policy

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this standard. Commits the organisation to continuity and recovery objectives; the resilience domain's single policy.
• XLSExcel

  Critical Service Recovery Objectives Matrix (RTO, RPO, MTD)

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this standard's applications and data criticality analysis. Records recovery objectives per service and flags inconsistencies between dependent systems.
• DOCWord

  Cyber Recovery Plan Template

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this standard's disaster recovery plan. Service-level recovery plan with priorities, dependencies, clean-build sources and decision authorities.
• XLSExcel

  Business Impact Analysis Questionnaire

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this standard's applications and data criticality analysis. Gathers each critical service's business impact analysis with its business owner, process by process: busy periods, the least each process needs, and the harm over time that sets the service's maximum tolerable downtime.
• DOCWord

  Site & Business Unit Continuity Plan Template

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this standard's emergency mode operation plan. One site's or business unit's plan for losing its building, a large part of its people, a supplier or its systems, with the first steps, the minimum resources and the vital records.
• DOCWord

  IT Disaster Recovery Procedure

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this standard's disaster recovery plan. Recovers the systems a critical service needs after a failure that is not an attack: the failover decision, each system's recovery method and runbook, and failback.
• DOCWord

  Continuity & Disaster Recovery Test Plan and Report

  in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References cite this standard's testing and revision procedures. Plans each recovery test, failover test or workaround trial so it cannot cause the outage it rehearses, and reports the time achieved, the data lost and the findings.