The HIPAA contingency plan standard in 164.308(a)(7) requires policies for responding to emergencies that damage systems with ePHI. It has three required parts, a data backup plan, a disaster recovery plan and an emergency mode operation plan, and two addressable ones, testing and revision, and applications and data criticality analysis.
The five parts
Required:
- Data backup plan: create and maintain retrievable exact copies of ePHI.
- Disaster recovery plan: be able to restore data lost in an emergency.
- Emergency mode operation plan: keep critical business processes running while protecting ePHI during an emergency.
Addressable:
- Testing and revision procedures: periodically test and revise the plans.
- Applications and data criticality analysis: assess how critical each application and data set is to the plan.
Backup: retrievable is the key word
A backup you cannot restore is not a retrievable exact copy. Test restores, not just backup jobs. Keep copies that an intruder with admin rights cannot delete or encrypt. CISA's ransomware guide advises offline, encrypted backups that are tested regularly, plus golden images and infrastructure as code templates for rebuilding systems.
Disaster recovery: order matters
Write the restoration order before you need it. The criticality analysis feeds this directly. List each application, its owner, its dependencies, and how long the organization can operate without it. Identity services and networking usually come first, because everything else depends on them.
Emergency mode: how care continues
This is the part that is easy to leave vague. Emergency mode asks how critical processes continue while systems are down, with ePHI still protected. Examples: paper downtime forms with a plan for entering them later, read only downtime copies of medication and allergy data, and a rule for who may use break-glass access. Practice the switch.
Testing
Run a tabletop each year at least, and a real restore test for the most critical systems. Record the findings and fix them. A dated test report is strong evidence.
Common gaps
- Backups on the same network and accounts as production.
- No documented restore order.
- Paper procedures that nobody has printed or rehearsed.
- Plans that ignore cloud and software as a service vendors.
Related reading: first hours of a hospital ransomware incident.
Quick check
Which contingency plan items are required?
Data backup plan, disaster recovery plan and emergency mode operation plan. Testing and criticality analysis are addressable.
Sources
Last reviewed: 19 October 2026.
