Consider a hospice whose electronic health record becomes unavailable overnight. The on-call nurse needs a care plan. A pharmacy interface cannot transmit an order. A family is calling about uncontrolled symptoms. At that moment, ‘business continuity’ is not an abstract IT objective; it is the question of how a clinical team will provide safe care and maintain a reliable record when its ordinary tools are missing.
Healthcare organizations have overlapping, but not identical, duties in this area. HIPAA requires contingency measures for electronic protected health information within the Security Rule’s scope. Medicare-certified hospitals, hospices, and home health agencies have additional provider-type-specific emergency preparedness requirements. A generic policy binder or a vendor’s promise of cloud backups cannot demonstrate that essential services can continue during an outage.
November 3, 2014, also marked the opening of One World Trade Center, an extraordinary landmark of rebuilding after the September 11 attacks. The circumstances are not comparable to a routine systems failure. The narrower institutional lesson is that recovery and continuity depend on responsibilities defined before the emergency, not invented in its midst. For a healthcare organization, that preparation has direct patient-care and legal consequences. [1]
HIPAA’s contingency rule already requires concrete planning
The HIPAA Security Rule applies to electronic protected health information (ePHI) maintained by covered entities and business associates within its scope. Under 45 C.F.R. 164.308(a)(7), regulated organizations must establish and implement as needed policies and procedures for responding to emergencies or other occurrences that damage systems containing ePHI. The rule identifies required data backup, disaster recovery, and emergency-mode operation plans. It also identifies testing and revision procedures and applications-and-data criticality analysis as addressable implementation specifications. [2]
The word “addressable” deserves attention. It does not mean a regulated entity may simply ignore the specification. Under the Security Rule framework, the entity evaluates whether the specification is reasonable and appropriate, implements it if so, or documents an appropriate alternative and the rationale if not. The distinction matters because an organization may believe that possessing an automated cloud backup solves every contingency obligation. It does not.
A backup is useful only if it can be located, accessed, restored, and trusted when needed. The organization must know which systems and data are critical, which vendors hold them, how quickly they can be recovered, and how clinical teams will function while the restoration occurs. HHS OCR’s ransomware guidance expressly connects contingency planning, recovery testing, and continued operations during a cyber incident. [3]
Recovery priorities are clinical decisions as well as IT decisions
Consider a home health agency whose EHR becomes unavailable on a Friday evening. A technology-focused response may prioritize server restoration. A clinically focused response must also determine which patients require medication administration, wound care, oxygen management, or urgent visits during the outage. It needs current schedules, care plans, contact information, physician orders, and a way to document what staff actually did. A restored server is too late if the agency cannot identify which high-risk patient needs attention tonight.
A hospice faces related but distinct risks. Families may need immediate access to an on-call nurse, symptom-management instructions, medication coordination, and alternate clinical coverage. If a vendor controls after-hours calls or a pharmacy interface, a failure may be both a clinical and contractual problem. The continuity plan should identify manual workflows, emergency contacts, backup communications, and clinical escalation authority in advance.
For a physician practice, even a temporary outage can affect prescription refills, test-result follow-up, referrals, prior authorizations, and documentation. A plan that says “use paper charts” should explain how staff will identify patients, retrieve essential clinical data lawfully, protect new handwritten records, and reconcile them into the EHR after recovery. Without reconciliation, an emergency process can become an enduring billing or safety defect.
CMS imposes provider-type-specific emergency preparedness duties
HIPAA is not the entire legal framework. Medicare Conditions of Participation contain emergency preparedness requirements for several kinds of providers. Hospitals are governed by 42 C.F.R. 482.15, hospices by 42 C.F.R. 418.113, and home health agencies by 42 C.F.R. 484.102. These regulations address an all-hazards approach and include requirements concerning risk assessment, policies, communication, training, and testing, with details that vary by provider type. [4][5][6]
For hospices, the regulation includes planning for continuity of operations, patient and workforce communication, record availability, emergency staffing strategies, and arrangements with other providers when the organization cannot continue ordinary operations. For home health agencies, the regulation likewise requires an emergency preparedness program calibrated to patients and the agency’s capabilities. Hospitals have additional institution-specific duties reflecting their scope and patient populations.
The program cannot be copied wholesale from another provider type. An office-based physician practice may have different regulatory obligations from a hospital or Medicare-certified hospice. State licensure rules, accreditor standards, payer contracts, and local emergency requirements may create additional duties. The legal work starts with identifying the entity and its actual operating model rather than purchasing a generic “CMS-compliant” binder.
Vendors and outsourcing create hidden single points of failure
Healthcare organizations increasingly operate with cloud-based EHRs, outsourced billing, remote call centers, contracted staffing, external laboratories, and managed cybersecurity vendors. These arrangements can improve resilience when properly designed. They can also concentrate operational risk in a supplier the organization cannot control. The contract should define the systems and data involved, service availability, security safeguards, incident escalation, recovery responsibilities, and exit rights.
When protected health information is involved, determine whether the vendor is a HIPAA business associate and whether the required business associate agreement is in place. HHS OCR guidance and 45 C.F.R. 164.504(e) explain required contract terms, including restrictions on use and disclosure, safeguards, breach reporting, subcontractor obligations, and return or destruction provisions when feasible. A business associate agreement is necessary in applicable circumstances, but it is not an adequate substitute for operational service-level language. [7][8]
An important diligence exercise is to ask the vendor to describe the failure scenario, not merely its uptime percentage. What if the EHR is down for 72 hours? What if the telephone platform is unavailable? Who has emergency export rights? Where are backup files stored, how are they protected, and how is restoration tested? What records survive contract termination? If an alternate provider must take over patient care, how quickly can the organization transfer the information needed for safe continuity?
Incident response and breach notification are related, but not identical
A ransomware event, lost laptop, misdirected email, or compromised service provider may trigger cybersecurity response even where the organization has not yet established that a reportable HIPAA breach occurred. The Security Rule requires response to suspected or known security incidents and appropriate mitigation and documentation. A breach analysis under the Privacy and Breach Notification Rules requires additional facts, including whether unsecured protected health information was involved and whether an exception or appropriate risk assessment changes the notification duty. [2][9]
HHS explains that individual notices for reportable breaches generally must be issued without unreasonable delay and no later than 60 days after discovery. Notifications to HHS and sometimes the media have their own conditions and timing rules, including requirements triggered by a breach affecting 500 or more individuals. Those time limits are legal ceilings, not recommendations to postpone action until the sixtieth day. Actual obligations depend on the breach facts and affected entity. [9]
A sound incident plan identifies who preserves forensic evidence, who maintains attorney-client communications where legally appropriate, who contacts cyber insurers, who evaluates patient-care risk, and who makes notification decisions. The plan should prevent premature public statements that confuse a system outage with a confirmed exfiltration of patient information. It should also prevent the opposite problem: a communications vacuum that leaves patients and staff without practical instructions.
Distinguish current requirements from proposed cybersecurity changes
HHS issued a proposal in late 2024, published in January 2025, to strengthen the HIPAA Security Rule. As of this November 2026 discussion, organizations should track that proposal through the federal rulemaking process rather than treat proposed obligations as though they automatically replaced the current regulation. The existing contingency, security incident, risk analysis, and business associate provisions are already enforceable, independent of any future change. [10]
That distinction is especially important for budgeting. A hospital may reasonably choose to improve network segmentation, backup isolation, identity controls, and recovery testing beyond the minimum legal text because those measures reduce patient and operational risk. Management should identify that spending as a risk-based investment, while distinguishing it from obligations already imposed by law. Honest classification makes a capital request stronger, not weaker.
A 90-day resilience exercise for a healthcare business
During the first thirty days, inventory critical systems, patient-care activities, suppliers, responsible individuals, and available backup data. Identify the patients or workflows most vulnerable to interruption. Review provider-specific CMS emergency requirements and HIPAA controls. Resolve missing business associate agreements and update the emergency contact chain.
During days thirty-one through sixty, test a realistic tabletop scenario: the EHR and telephone system fail for two days while a key employee is unavailable. Ask clinical and administrative staff to show exactly how they would reach patients, retrieve necessary information, furnish care, capture new records, and preserve claim support. Record gaps and assign corrective actions. A tabletop conversation should reveal which assumptions were never tested.
During days sixty-one through ninety, conduct a selected recovery or continuity drill, verify restoration of representative information, and exercise at least one vendor escalation path. Update contracts or policies where the exercise revealed a dependency. Report results to management in terms of patient-care risk, achievable recovery times, regulatory exposure, and the cost of improvement. Then establish a cadence for further testing consistent with the applicable standards and the organization’s risk profile.
The 24-hour continuity test
At the next leadership meeting, ask a concrete question: if the EHR, telephone system, and primary vendor were unavailable for 24 hours, who would contact high-risk patients, how would clinicians retrieve essential orders, and where would the record of care be kept? If the answers rely on a single unavailable person or system, the plan needs revision.
Regulatory documentation matters, but usability matters just as much. The most persuasive contingency program is not the thickest binder. It is the one a clinical team has practiced, a vendor can support, and leadership can verify before patients have to depend on it.
Authorities and Further Reading
- HISTORY, One World Trade Center opens on November 3, 2014
- 45 C.F.R. 164.308, HIPAA administrative safeguards and contingency planning
- HHS OCR, Fact Sheet: Ransomware and HIPAA
- 42 C.F.R. 482.15, Hospital emergency preparedness
- 42 C.F.R. 418.113, Hospice emergency preparedness
- 42 C.F.R. 484.102, Home health emergency preparedness
- HHS OCR, Business Associates FAQs
- 45 C.F.R. 164.504(e), HIPAA business associate contracts
- HHS OCR, HIPAA Breach Notification Rule
- HHS OCR, HIPAA Security Rule Notice of Proposed Rulemaking
General information only; not legal advice. Legal rules and payer policies should be verified for the specific facts and date of service.