Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

Update: Disaster Recovery

In the midst of tropical storm season, we want to remind you of the importance of a Disaster Recovery Plan. The most recent storm, Hermine, has caused floods and flash flooding in many areas of the Southeastern US. Natural disasters like this are exactly why we need Disaster Recovery Plans to protect not only PHI, but all your business data. A Disaster Recovery Plan describes how an organization plans to handle potential disasters, created both by natural causes and human error. HIPAA requires your agency to have a fully developed and tested Disaster Recovery Plan.

For example, consider recent events during the NFL preseason. On August 25th, Dallas Cowboys quarterback, Tony Romo, suffered an L1 compression fracture in his back, but the team had drafted a talented quarterback in Dak Prescott in the 4th round to be ready to lead at any time in case of a disaster.¹ Teddy Bridgewater, quarterback of the Minnesota Vikings, suffered a torn ACL during a non-contact practice drill on August 31st.² The Vikings were hurried to find a replacement, taking a more reactive approach rather than proactive. When it comes to your Disaster Recovery Plan, there must be more than one person trained to keep your (business) systems running; whether it is your servers going down, a natural disaster, or simply a drill. Your business should construct your plan to include more than one person able to quarterback your team to victory during a crisis. So be more like the Dallas Cowboys, prepared to face adversity, rather than the Minnesota Vikings, left scrambling for a fix.     


To be proactive, follow these 9 Steps for Creating a Disaster Recovery Plan:

    1. Designate your primary crisis managers
    1. List employees and their emergency contact information
    1. Identify major clients’ contact information
    1. Keep a record of vital financial relationships
    1. Inventory your devices
    1. Design an evacuation plan based on disaster type
    1. Determine who is in charge of restoring the network
    1. Create a potential purchase list
  1. Estimate disaster recovery times

Testing and Feedback

It is not enough to simply have a plan in place; your plan should also be tested because it assures that everyone involved understands the process in depth. Testing can also help you determine which parts of your plan work well and which parts can be improved upon in order to be most effective and successful. After testing your plan, your team should evaluate and document the effectiveness of your plan and your workforce. For more information about different types of tests you can run and what to do after a test, visit our previous blog about Disaster Recovery Plans here.

Backup and Recovery

The most important parts of a Disaster Recovery Plan are the backup and recovery of the data itself. Doing all the planning and testing in the world would be useless if there is no data to recovery. Likewise, there is no purpose in planning if there is no one who knows how to recover the data from the server or PC.

Ensuring the confidentiality, integrity, and availability of all PHI you create, receive, maintain or transmit is required under HIPAA.³ We recommend your organization backup all data on a daily basis to prevent loss in case of accidental deletion, natural disaster, system failure, or corruption.

There are two common ways electronic data is stored. Which one you use will determine your backup method.

  1. Cloud Computing: Cloud storage providers have the capabilities to allow copies of data to be remotely stored and maintained as a security measure.⁴ Your data is stored in another location and accessed from your device through the internet. This especially comes in handy in the event of a disaster. To assure all areas of the Disaster Recovery Plan are covered by your cloud storage vendor, a Business Associate Agreement is required to be signed by each party.
  2. Internal Server: If your organization stores data locally on a server(s), there are some precautions to consider. Backing up the server(s) is essential, but what if it’s infected by malware? We recommend you have secondary drives with your data stored at an off-site location (e.g. safety deposit box, safe).   

(Here is a interactive infographic from Lenovo about decisions regarding internal servers. Check it out to see the importance of a reliable internal server in the event of a disaster.)

As mentioned previously, multiple people should be trained on how to perform a recovery. Additionally, be sure the people doing the recovery are involved in creating the Disaster Recovery Plan. Employees usually find it challenging to write documentation that is clear enough for another person to use. So if those doing the recovery are involved in creating the document, they should not find the procedures hard to follow. Disaster Recovery Plans should not be a one shot deal; they need to be continually updated to reflect changes within the organization and technology. The Plan should also be broken down by each hypothetical situation, because an electrical surge will necessitate a different strategy compared to flooding in the building.

Consequences for not preparing a Disaster Recovery Plan can result in damage to your business’ reputation, potential penalties and fines by government entities, and greater risk to your clients’ confidential information.   

    1. http://www.wlky.com/sports/cowboys-might-place-romo-on-ir/41470384
    1. http://www.espn.com/nfl/story/_/id/17424174/teddy-bridgewater-suffers-serious-knee-injury-minnesota-vikings-practice
    1. http://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/
  1. http://searchcloudstorage.techtarget.com/definition/cloud-disaster-recovery-cloud-DR

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)