Disaster Recovery Plan

A disaster recovery plan is an HIPPA security standard and its objectives are to establish policies and procedures for responding to an emergency (vandalism, system failure, and natural disaster) that may damage or interrupt systems that contain PHI. In brief, the Health Insurance Portability and Accountability Act, commonly known as HIPAA, was enacted on August 21, 1996, by the United States Congress and signed President Bill Clinton. HIPPA regulates national standards to protect individuals’ health information that is created, received, used, or maintained by a healthcare industry and non-healthcare industries.
HIPAA Security Rule (Section 164.308) requires safeguards to ensure the confidentiality and security of electronic protected health
The consequences of not having a disaster recovery plan in healthcare cannot be overstated. Regardless of the industry, when a catastrophic event takes place and brings a hospital’s department day-to-day operations to a halt, a hospital needs to recover as soon as possible to provide services to their staff and patients. The consequences of lost data from a disaster are significant and may include the risk of mission critical devices losing data required for patient care that can have life-or-death consequences, great risk of losing credibility and reputation from stakeholders and patients, risk of acquiring HIPAA penalties for non-compliance, which are greater now under HITECH, risk of financial losses from lost business, and the risk of litigation costs if patients litigate the healthcare
Every organization is different and a one size fit all disaster recovery plan would not be an ideal plan for all organizations. Assessing the size of a disaster recovery plan is an important step in cost estimation. Lack of funding is often a reason why organizations do not have a disaster recovery plan. This is a contradiction. Developing a disaster recovery plan costs no money aside from the staff time needed to develop the plan. However, if organizations fail to set aside money in advance for disaster-recovery planning, they will see themselves spending far more money after a disaster. In a Gartner survey of 205 IT manager, it states “24 percent of the respondents said that lack of funds was preventing implementation of a disaster-recovery plan. One in three companies even admitted they would lose critical data or operational capability if a disaster occurred. And 37 percent indicated they needed additional funding to carry out their disaster-recovery plan (Salamone, 2003,