HIPAA Contingency Plan 45 CFR 164.308(a)(7)
The Contingency Plan standard is HIPAA's business-continuity and disaster-recovery requirement. Five implementation specifications cover backup, recovery, emergency-mode operations, testing, and criticality analysis.
What the regulation requires
Ransomware and cloud-vendor outages have made this standard the second most-cited HIPAA finding. Three of the five specifications are required, two are addressable.
Implementation specifications
Data Backup Plan
Establish and implement procedures to create and maintain retrievable exact copies of ePHI. (164.308(a)(7)(ii)(A))
Disaster Recovery Plan
Establish (and implement as needed) procedures to restore any loss of data. (164.308(a)(7)(ii)(B))
Emergency Mode Operation Plan
Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of ePHI while operating in emergency mode. (164.308(a)(7)(ii)(C))
Testing and Revision Procedures
Implement procedures for periodic testing and revision of contingency plans. (164.308(a)(7)(ii)(D))
Applications and Data Criticality Analysis
Assess the relative criticality of specific applications and data in support of other contingency plan components. (164.308(a)(7)(ii)(E))
How Petronella implements this safeguard
Every Petronella HIPAA engagement maps 45 CFR 164.308(a)(7)(i) to documented evidence in your environment. This is what that looks like in practice for the hipaa contingency plan standard:
- Immutable, encrypted backups with the 3-2-1 rule (three copies, two media, one off-site, one offline) and tested monthly.
- Quarterly restore tests against a sample of patient charts, billing records, and imaging studies, with documented RTO and RPO.
- Emergency-mode operating procedures: paper templates, downtime workflows, and a tested manual EHR fallback.
- Annual disaster recovery exercise that takes a simulated production outage and runs through full recovery.
Built on top of ComplianceArmor for documentation, training records, and BAA inventory, with optional HIPAA managed IT services for the technical safeguard layer and vCISO services for the named Security Official role.
Where most practices fall short
OCR resolution agreements, HHS audit reports, and our own engagements show the same handful of gaps under 45 CFR 164.308(a)(7)(i). We surface these before they become a finding.
- Backups exist but have never been restored - frequently fail when actually needed (the most-cited Contingency Plan finding).
- Backups are not encrypted or are accessible from the same domain admin account that ransomware would compromise.
- Emergency-mode procedures are theoretical; clinical staff has never practiced downtime workflows.
- Criticality analysis missing entirely - so during a real incident, leadership cannot decide what to bring up first.
Related HIPAA safeguards
HIPAA Contingency Plan interacts with several other Security Rule standards. Cover them together for a defensible program.
Need help with HIPAA Contingency Plan?
Penny answers before the third ring, asks 3 qualifying questions, then books your free 15. Or jump straight to the platform that runs your HIPAA program.