Free HIPAA reference template · v1.0 · Applies to covered entities & business associates
Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:
Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:
Exploits: Unpatched systems; no tested backups · 164.308(a)(7) Contingency; 164.308(a)(5)(ii)(B) Malware
Exploits: No DR plan; no RTO · 164.308(a)(7)(ii)(B) Disaster Recovery
Exploits: No line of succession; key-person risk · 164.308(a)(7) Contingency Plan
Template. The step-by-step for restoring systems and ePHI after a disruptive event. Replace
[bracketed]items and keep the contact list current. Satisfies the Disaster Recovery Plan at 45 CFR § 164.308(a)(7)(ii)(B).
This plan is activated by [Security Official / IT lead] when an event (outage, ransomware, facility loss) prevents normal access to ePHI beyond [threshold]. Activation is logged.
| System (priority order) | RTO | RPO | Restore source |
|---|---|---|---|
| [EHR] | [4h] | [24h] | [vendor + backup] |
| [Email] | [8h] | [24h] | [cloud] |
| [File storage] | [8h] | [24h] | [snapshot] |
See where your organization stands on the controls this template cites.
Join Us| Role | Name | Contact | Backup |
|---|---|---|---|
| Security Official | [Name] | [phone/email] | [Name] |
| IT / infrastructure | [Name] | [contact] | [Name] |
| [EHR vendor] support | [vendor] | [24/7 line] |
Tested at least [annually] (logged in the Contingency Plan Test Record) and reviewed after any major change or actual event. v1.0.