SuperHIPAA Book a demo

Platform feature

Backup & Recovery

Backup posture, tested restores, and the 72-hour recovery evidence the proposed Security Rule — and every ransomware playbook — now expects.

Book a demo Get your free HIPAA readiness score

Administrative safeguards Physical safeguards Technical safeguards Privacy rule Breach notification

Backup compliance fails during the restore, not the backup. Backup & Recovery is the record that the restore was tested — with the dated evidence a ransomware investigator, an insurer, or the proposed Security Rule’s 72-hour target will ask for.

What it does

  • Catalogs backup configuration per ePHI asset: scope, frequency, retention, encryption state.
  • Captures tested restores with a date, an operator, a successful-restore outcome, and the recovery time measured.
  • Reports the gap to the 72-hour target the proposed Security Rule adds, so the exposure is visible.
  • Links to the Contingency Plan test evidence §164.308(a)(7) requires.

How it maps to HIPAA

The feature satisfies §164.308(a)(7)(ii)(A) (data backup plan), §164.308(a)(7)(ii)(B) (disaster recovery plan), §164.308(a)(7)(ii)(C) (emergency mode operation plan), §164.308(a)(7)(ii)(D) (testing and revision), and §164.308(a)(7)(ii)(E) (applications and data criticality analysis).

Where it fits

Backup & Recovery is a Security module capability, feeds Breach Tracking when a recoverable incident becomes a breach, and reads asset context from Asset Inventory.

Questions

Does the platform run the backups?

No. Your infrastructure runs the backups. The platform records that backup is configured per asset, that restores were tested, and that the recovery objective was met — the compliance record, not the backup.

What is the 72-hour requirement?

The proposed Security Rule (RIN 0945-AA22) would require critical electronic information systems to be restored within 72 hours of an incident. The feature tracks that target by asset and surfaces assets that have not been tested against it.

See your compliance program in one place

A 20-minute walkthrough with a practitioner. No slides, no pressure.

Book a demo