HIPAA Glossary · Security Rule concepts
Contingency plan
The required trio of data backup plan, disaster recovery plan, and emergency mode operation plan — tested, not just written.
Context
Required by §164.308(a)(7). Five implementation specifications: data backup, disaster recovery, emergency mode operation, testing and revision procedures, and applications and data criticality analysis. Testing is where this standard falls over most often — a backup that was never restored is a document, not a plan. See [Backup & Recovery](/platform/backup-and-recovery/).
Related terms
- Administrative safeguards — The management layer of the Security Rule — risk analysis, workforce security, training, incident procedures, contingency planning, evaluation.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.