By Iseman Cunningham Riester & Hyde LLP
Covered Entities must develop a plan to ensure that critical business processes for the protection of electronic health information continue while the Covered Entity is operating in emergency mode. The “emergency mode operations” plan is the third required component of the “contingency plan” standard and is mandatory for all covered entities (see related Tip#8: Data Backup and #9 Disaster Recovery).
“Emergency mode operations” is the period between recovery (the onset of restoration activity) and reconstitution (when the emergency has abated and system functions return to normal). The emergency mode operations plan requires Covered Entities to imagine how operations might be carried out in the event of certain disasters, and then devise effective security rules to protect electronic health information during those operations.
Although good business practice suggests a plan for the continuation of all critical business operations, the HIPAA emergency mode operations plan requirement concerns itself only with those that relate to the protection of electronic health information. This requirement reflects a policy decision that the security of electronic patient health information must not be compromised even under the direst of circumstances.
Covered Entities should not confuse the security contingency plan requirement with the “contingency plan” related to electronic transactions. That plan was limited to the narrow scenario of a disruption in operations due to failure to comply with the transactional standards, the deadline for which was October 16, 2003. The security contingency plan should cover a much broader array of potential disruptions.
HIPAA Security Tips are written by the attorneys of Iseman, Cunningham, Riester & Hyde, LLP. ICR&H is known for legal work on complex legal problems and transactions for businesses and individuals in the healthcare, construction, and financial industries, among other areas.
(c) 2004 Iseman Cunningham Riester & Hyde LLP. License is granted for all attributed reproduction.
