164.308(a)(7)(i) Contingency Plan (Standard)
Administrative safeguard · Standard
The requirement as we hold it
Contingency Plan (Standard). Establish policies for responding to emergencies that damage ePHI systems. NIST recommends contingency planning per SP 800-34 with business impact analysis driving recovery priorities.
The examiner asks
- Show me the policy for responding to emergencies that damage ePHI systems.
- What business impact analysis drives your recovery priorities?
Evidence to bring
- the contingency policy
- the business impact analysis
Source: 164.308(a)(7)(i) at eCFR. Our statement of the clause, not the instrument verbatim.