A contingency plan is a requirement of the HIPAA Security Rule. There must be a plan in the event of a disaster, power failure, or other emergencies that limit or remove access to ePHI and the convenience of services in everyday operations. A contingency plan allows a business to return to operations and provide business as usual to some degree. A contingency plan prevents an organization from ceasing all operations. Specifically, in healthcare, this is something that should never happen. Healthcare organizations should continue to provide patient care or plan to move patients to another location as quickly as possible and the health information about the patient's treatment.

There are several parts to a contingency plan that are required by HIPAA Security Rule (45 CFR 164.308(a)(7) that must be included to secure ePHI:

• Risk assessment and analysis (in your course project)
• Downtime and contingency planning
• Data backup
• Disaster recovery
• Emergency mode of operation

Explain what will happens during downtime and what is the contingency plan for the health information department. Next, include how data backup will take place. Keep in mind that data backup could already be a part of daily operations. If so, include a description of the backup process and how employees can access data during emergency operations. Your plan should also include how the health information department will recover. How will the department return to normal operations following the emergency or disaster? Lastly, explain what will happen with data collection during the emergency mode of operation. For example, how will the newly collected information be protected? What happens to employees (how do employees report to work? What is the impact on the core processes (explain a minimum of 3 functions; data analysis, release of information, coding, etc.)?