HIPAA's contingency plan standard in 164.308(a)(7) requires three plans for systems holding ePHI: a data backup plan, a disaster recovery plan and an emergency mode operation plan. Testing and revision procedures and an applications and data criticality analysis are addressable, so you must assess them and document your decision.
What the standard says
You must establish and implement as needed policies and procedures for responding to an emergency or other occurrence that damages systems containing ePHI. The rule's own examples are fire, vandalism, system failure and natural disaster. It adds nothing on ransomware by name, but a destructive attack is plainly an occurrence that damages systems.
The implementation specifications are:
| Specification | Status | What it asks |
|---|---|---|
| Data backup plan | Required | Create and maintain retrievable exact copies of ePHI |
| Disaster recovery plan | Required | Procedures to restore any loss of data |
| Emergency mode operation plan | Required | Continue critical business processes while protecting ePHI in emergency mode |
| Testing and revision | Addressable | Periodic testing and revision of contingency plans |
| Applications and data criticality analysis | Addressable | Assess relative criticality of applications and data |
The word that matters: retrievable
A backup that cannot be restored does not meet the intent of "retrievable exact copies". The wording pushes you toward restore tests, not just backup jobs. Many teams discover during a real incident that their backups lack a key, a schema or a dependency.
Also note that backups are themselves ePHI. They need the same access control, encryption decisions and logging as production, which is easy to forget for cold storage and cross region copies.
Making each plan concrete
- Backup: define scope by data class, frequency, retention, location and who can restore. Include configuration and secrets needed for a restore.
- Disaster recovery: set target recovery times per system, written runbooks, and a named decision maker. Cover the case where your cloud region or primary vendor is unavailable.
- Emergency mode: decide which functions must keep running, how staff reach ePHI safely if normal access paths fail, and how emergency access is logged. This links to the required emergency access procedure in the technical safeguards.
- Criticality analysis: rank systems so recovery order matches clinical and business impact. Software dependencies matter here, because a recovery can stall on a package registry or image source you cannot reach.
Testing without waiting for a disaster
Even though testing is addressable, skipping it needs a documented reason and an alternative. A simple annual cycle works for many teams:
- Run a restore of a representative dataset to a clean environment.
- Time it against your recovery target.
- Run a tabletop for an emergency mode scenario.
- Record the findings and update the plan.
- Keep the record, since required documentation must be retained for six years. See documentation retention.
Quick check
Are backups required under HIPAA?
Yes. A data backup plan that creates and maintains retrievable exact copies of ePHI is a required specification.
Is testing the contingency plan optional?
It is addressable, which means you must assess it and either implement it or document why not and use an equivalent measure. See the post on addressable specifications.
Sources
- 45 CFR 164.308, administrative safeguards
- 45 CFR 164.312, technical safeguards
- 45 CFR 164.316, documentation requirements
Last reviewed: 19 October 2026.
