Contingency Plan

The Contingency Plan section of the Administrative Rule is made up of 5 tasks. 3 of these tasks are required and 2 are addressable. These tasks establish and implement policies and procedures for responding to an emergency that damages systems that contain EPHI. This section can take some time to complete, although you may already have some portions covered under other policies and procedures.

The first Contingency Plan task is the Data Backup Plan. You must establish and implement procedures to create and maintain retrievable exact copies of EPHI.

Most agencies already have this task covered. However, you should review and document your backup procedure to insure you are confident that EPHI data can be recovered in case of a disaster.