For healthcare organizations that handle electronic protected health information, business continuity starts with a rule: HIPAA's Security Rule requires a contingency plan covering data backup, disaster recovery and emergency mode operation. Clinical continuity goes further, but those three are the legal floor for the data.
What does the regulation actually say?
Section 164.308(a)(7) of the Security Rule requires covered entities and business associates to establish policies and procedures for responding to an emergency or other occurrence that damages systems containing electronic protected health information. The regulation gives examples: fire, vandalism, system failure and natural disaster.
It lists five implementation specifications.
- Data backup plan (required): create and maintain retrievable exact copies of ePHI.
- Disaster recovery plan (required): procedures to restore any loss of data.
- Emergency mode operation plan (required): procedures to keep critical business processes running while protecting ePHI in emergency mode.
- Testing and revision procedures (addressable): periodic testing and revision of contingency plans.
- Applications and data criticality analysis (addressable): assess how critical each application and data set is.
"Addressable" does not mean optional. It means you must assess whether the measure is reasonable for your environment and implement it or document an equivalent alternative.
How is business continuity different from disaster recovery?
Disaster recovery restores systems and data. Business continuity keeps the organization working while that restoration happens. In a hospital, that means asking what staff do when the records system is down for six hours: paper forms, downtime procedures, a way to look up allergies, a plan to back-enter data later. The regulation's emergency mode operation requirement is the closest legal hook for that thinking.
What should a plan cover? A constructed example
Picture a regional clinic network with an electronic health record hosted by a vendor, a billing system, and imaging software on local servers. A ransomware event takes the local imaging servers offline.
A workable plan has already answered these questions:
- Which of the three systems is most critical, and what is the longest acceptable outage for each? That is the criticality analysis.
- Where are the backups, who can restore them, and when did anyone last do a restore test?
- Which paper or manual workflows start at hour one, and who authorizes them?
- Who calls the vendor, who informs patients and regulators if required, and who holds the contact list when email is down?
- How is access controlled in emergency mode so that convenience does not become a breach?
The most common failure is not a missing document. It is a backup that nobody has restored from, or a contact list stored on the system that just failed.
What do people forget?
Three things come up again and again. First, vendors: your electronic health record host, your billing processor and your cloud provider are all part of your continuity story, and their outage is yours. Second, people: the plan must say who is allowed to make decisions at 3 am, and who covers if that person is unreachable. Third, return to normal: after systems come back, someone must reconcile paper records with the electronic ones and confirm that nothing was lost or entered twice. A plan that ends at "systems restored" is half a plan.
How to check or apply this
- List systems that create, receive, maintain or transmit ePHI, including vendor hosted ones and medical devices.
- Rank them by clinical and operational criticality and write a maximum tolerable downtime for each.
- Confirm that backups are retrievable, kept separate from the systems they protect, and tested by an actual restore.
- Write downtime procedures for clinical staff and print them. Store copies where staff can reach them offline.
- Run a tabletop exercise at least once a year, record what failed, and revise the plan.
- Review business associate agreements to learn what your vendors promise for recovery.
Quick check
Is a backup enough to satisfy the contingency plan requirement?
No. The backup plan is one of three required specifications. You also need a disaster recovery plan and an emergency mode operation plan.
Do business associates need a contingency plan too?
Yes. Section 164.308 applies to business associates as well as covered entities. Check their plans through contract and due diligence.
Sources
This article explains a regulation and is not legal advice. Safeguard does not certify HIPAA compliance.
Last reviewed: 18 October 2026.
