Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

Preparing For Every Disaster

While recovery from Hurricane Harvey is under way and evacuations begin in Florida as Irma approaches, Total HIPAA wants to remind you of the importance of a Disaster Recovery Plan. Fires in the west, flooding from Harvey and destruction expected from Irma are exactly why you need a Disaster Recovery Plan to protect not only PHI but all of your business data.

A Disaster Recovery Plan describes how an organization plans to handle potential disasters, and enable you to quickly get your business functioning again. HIPAA requires your organization to have a fully developed and tested Disaster Recovery Plan.

When it comes to your Disaster Recovery Plan, there must be more than one person trained to keep your systems running; whether it is your servers going down, the destruction of your computers or the loss of mobile devices caused by a natural disaster or human error.

Planning for the Disaster

To be proactive, follow these nine steps to create a Disaster Recovery Plan:

  1. Designate your primary crisis managers
  2. List employees and their emergency contact information
  3. Identify major clients’ contact information
  4. Keep a record of vital financial relationships
  5. Inventory of all devices
  6. Design an evacuation plan based on disaster type
  7. Determine who is in charge of restoring the network
  8. Create a potential purchase list
  9. Estimate disaster recovery times

Testing and Feedback

It is not enough to simply have a plan in place; your plan should also be tested because it assures that everyone involved understands the process in depth. Testing can also help you determine which parts of your plan work well and which parts can be improved upon in order to be most effective and successful. After testing your plan, your team should evaluate and document the effectiveness of the plan, as well as your workforce. For more information about different types of tests you can run and what to do after a test, visit our previous blog Testing Disaster Recovery Plans.

Backup and Recovery

The most important parts of a Disaster Recovery Plan are the backup and recovery of your data. Doing all the planning and testing in the world will be useless if there is no data to recover. Likewise, there is no purpose in planning if there is no one who knows how to recover the data from the server or the cloud.

Ensuring the confidentiality, integrity, and availability of all PHI you create, receive, maintain or transmit is required under HIPAA.1 We recommend your organization backup all data on a daily basis to prevent loss in case of accidental deletion, natural disaster, system failure, or corruption.

There are two common ways electronic data is stored. Which one you use will determine your backup method.

  1. Cloud Computing: Cloud storage providers have the capabilities to allow copies of data to be remotely stored and maintained as a security measure.2 Your data is stored in another location and accessed from your device through the internet. This especially comes in handy in the event of a disaster. To assure all areas of the Disaster Recovery Plan are covered by your cloud storage vendor, a Business Associate Agreement is required to be signed by each party.
  2. Internal Server: If your organization stores data locally on a server(s), there are some precautions to consider. Backing up the server(s) is essential, but what if it’s infected by malware? We recommend you have secondary drives with your data stored at an off-site location (e.g. safety deposit box, safe). Lenovo has a great interactive infographic about decisions regarding internal servers. Check it out to see the importance of a reliable internal server in the event of a disaster.

As mentioned previously, multiple people should be trained on how to perform a recovery. Additionally, be sure the people doing the recovery are involved in creating the Disaster Recovery Plan. Employees usually find it challenging to write documentation that is clear enough for another person to use. So if those doing the recovery are involved in creating the document, they should not find the procedures hard to follow. Disaster Recovery Plans should not be a one shot deal; they need to be continually updated to reflect changes in the organization and technology. The Plan should also be broken down by each hypothetical situation because an electrical surge will necessitate a different strategy compared to flooding in the building.

Consequences for not preparing a Disaster Recovery Plan can result in damage to your business’ reputation, potential penalties and fines by government entities, and greater risk to your clients’ confidential information.

Donation Opportunities

Hurricane Harvey has caused widespread, catastrophic flooding and damage in Texas and along the Gulf Coast. There are many organizations supporting the relief efforts and below are three incredible ones providing help to those who need it most. All donations to the following will exclusively support relief and recovery efforts from this storm. Citizens along the east coast in the current path of Hurricane Irma will also need assistance in the coming days.

American National Red Cross:

American Red Cross Logo

The American Red Cross is working around the clock along the Gulf Coast to help the thousands of people whose lives have been devastated by Hurricane Harvey. Help those in need through your contribution to the American Red Cross.

donate button

Houston Food Bank:

Houston Food Bank

Your support helps provide meals for hungry neighbors who have been affected by Hurricane Harvey. Together, we can help people in their greatest time of need.

donate button

Texas Diaper Bank:

Texas Diaper Bank Hurricane Harvey

The Texas Diaper Bank is reporting an extreme need for diapers. Your support will provide diapers to displaced families where there is an urgent request for donations, stating that diapers are not provided by disaster relief agencies.

donate button

  1. http://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/
  2. http://searchcloudstorage.techtarget.com/definition/cloud-disaster-recovery-cloud-DR

Sharing is caring!

Does your organization comply with HIPAA?

Find out if your organization needs to comply with HIPAA using our simple, fast, online questionnaire.

Start Questionnaire →

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)