- Citation
45 CFR 164.308(a)(7)- Standard
- Contingency plan, 164.308(a)(7)(i)
- Safeguard
- Administrative safeguards
- Type
- Standard, with three required and two addressable specifications
What the rule says
Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.45 CFR 164.308(a)(7), as currently in force
In plain English: Decide in advance how you'll keep patient information safe and available when something breaks: how it's backed up, how you'd recover it, how you'd keep treating patients in the meantime, and prove the plan works by testing it.
What it means in practice
- Data backup plan (R): exact copies of ePHI, retrievable, protected, and separate enough that ransomware can't reach them.
- Disaster recovery plan (R): how to restore data and systems, in what order, by whom.
- Emergency mode operation plan (R): how the practice keeps protecting ePHI while running on paper or a backup system.
- Testing and revision (A): restore from backup and run the plan periodically, and fix what the test exposes.
- Applications and data criticality analysis (A): which systems come back first. The EHR before the website.
What you do when the river floods. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- The written plans, approved and dated.
- Backup configuration and job success records.
- Restore test records with dates and results.
- The criticality ranking of systems.
Where entities get caught
Ransomware settlements are contingency plan cases in disguise. OCR's 21 ransomware enforcement actions through July 2026 nearly all cite the risk analysis, and the recovery stories behind them turn on whether backups existed and had been tested.
Corrective action plans routinely require a contingency plan and periodic testing.
How to meet it at a small organization
Automated backups to a location the office network can't overwrite, with a restore test every quarter or at least every year, timed and written down. A one-page emergency mode procedure: how to see today's schedule, how to chart on paper, who to call, how to keep paper secure until it's keyed in. Rank your systems once.
Under the proposed Security Rule update
The proposal would require written procedures to restore critical systems and data within 72 hours, a criticality analysis to set restoration priority, backups no older than 48 hours with monthly testing, and separate technical controls for backup and recovery systems. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: Backup completion is monitored as a control, restore tests are scheduled and recorded, the criticality ranking lives with the asset inventory, and the plans are drafted with the Policy Builder and reviewed by an in-house CISO.