By Iseman Cunningham Riester & Hyde LLP
HIPAA requires covered entities to establish procedures for recovering data lost in catastrophic events such as fire, vandalism, or natural disasters like floods and hurricanes. Disaster recovery is another required component of the “contingency plan” standard, which is a mandatory standard for all covered entities. (See related Tip#8: Data Backup.)
The structure of each covered entity’s disaster recovery plan will be driven mostly by its tolerance (or lack of tolerance) for unavailability of the system. The size of the organization is not necessarily a determining factor. A small office serving a highly critical function (for example, a dispatching call center) may need aggressive backup schedules and system redundancies to avoid even minute disruptions in service, while a larger division with more system resources may be able to tolerate a down period of multiple days or even weeks.
The disaster recovery plan should proceed in a logical and sequential fashion. In the restoration of a network, for example, network servers should be restored first before turning efforts to workstations and peripherals such as printers and scanners. But don’t count on your technology experts to know whether the printers in claims processing are more important than the databases in QI. With complex systems, appropriately prioritizing the steps of the disaster recovery plan will require close coordination between operations and IT managers.
HIPAA Security Tips are written by the attorneys of Iseman, Cunningham, Riester & Hyde, LLP. ICR&H is known for legal work on complex legal problems and transactions for businesses and individuals in the healthcare, construction, and financial industries, among other areas.
(c) 2004 Iseman Cunningham Riester & Hyde LLP. License is granted for all attributed reproduction.
