Incident Response & Operations
Data Backup Plan
A HIPAA-required plan to create and maintain retrievable copies of ePHI.
A Data Backup Plan is a required element of HIPAA's contingency plan: documented procedures to create and maintain retrievable, exact copies of ePHI.
The plan should specify what is backed up, how often, where copies are stored (including off-site backups), and how restoration is tested. Backups containing PHI must themselves be encrypted and access-controlled.