§164.308(a)(7)(i): Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information. Audit Inquiry Does the entity have policies and procedures in place that include a formal contingency plan for responding to an emergency or other occurrences that damages systems that contain ePHI? Does the entity have a contingency plan for responding to an emergency or other occurrences that damages systems that contain ePHI? Obtain and review policies and procedures related to a formal contingency plan. Elements to review may include but are not limited to: • Identification of workforce members’ roles and responsibilities in the contingency process • Workforce members or roles to which the contingency policies and procedures are to be disseminated • Management involvement in contingency plans • Coordination of contingency processes among business associates • Identification of what steps should be taken in a contingency plan • The frequency to review and update current contingency policies and procedures • How frequently the contingency plan is tested Obtain and review documentation demonstrating that a contingency plan is implemented. Evaluate and determine that the response to an emergency or other occurrence that damages systems that contain ePHI include appropriate capabilities to recover access to ePHI. Required/Addressable Required

FAQs Archive

Contingency Plan — Emergency Mode Operation Plan

§164.308(a)(7)(ii)(C): Establish (and implement as needed) procedures to enable continuation [...]

Jason Russell2020-09-13T12:15:18-04:00Security|

Contingency Plan –Disaster Recovery Plan

§164.308(a)(7)(ii)(B): Establish (and implement as needed) procedures to restore any [...]

Jason Russell2020-09-13T12:14:33-04:00Security|

Contingency Plan – Data Backup Plan

§164.308(a)(7)(ii)(A): Establish and implement procedures to create and maintain retrievable [...]

Jason Russell2020-09-13T12:13:38-04:00Security|

Contingency Plan

§164.308(a)(7)(i): Establish (and implement as needed) policies and procedures for [...]

Jason Russell2020-09-26T14:43:48-04:00Security, Terms & Definitions|

Security Incident Procedures — Response and Reporting

§164.308(a)(6)(ii): Identify and respond to suspected or known security incidents; [...]

Jason Russell2020-09-13T12:11:56-04:00Security|

Security Incident Procedures

§164.308(a)(6)(i): Implement policies and procedures to address security incidents. Audit [...]

Jason Russell2020-09-13T12:11:08-04:00Security|

Security Awareness, Training, and Tools — Password Management

§164.308(a)(5)(ii)(D): Procedures for creating, changing, and safeguarding passwords. Audit Inquiry [...]

Jason Russell2020-09-13T12:10:27-04:00Security|

Security Awareness, Training, and Tools — Log-in Monitoring

§164.308(a)(5)(ii)(C): Procedures for monitoring log-in attempts and reporting discrepancies. Audit [...]

Jason Russell2020-09-13T12:09:40-04:00Security|

Security Awareness, Training, and Tools — Protection from Malicious Software

§164.308(a)(5)(ii)(B): Procedures for guarding against, detecting, and reporting malicious software. [...]

Jason Russell2020-09-13T12:08:54-04:00Security|

Security Awareness and Training — Security Reminders

§164.308(a)(5)(ii)(A): Periodic security updates. Audit Inquiry Does the entity have [...]

Jason Russell2020-09-13T12:08:03-04:00Security|