The HIPAA Security (Final) Rule requires a "System Emergency Response (contigency)Plan" that includes a "Data Backup Plan", a "Disaster Recovery Plan", and an "Emergency Mode Operation Plan" [45 CFR 164.308(a)(7)]. The rule doesn't specify how to create these plans, as the DHHS wants industry professionals impliment "best practices". These plans are to be based upon the "Data Security Risk Analysis" (required), Information System Activity Review" (required), and "Applications and Data Criticality Analysis" (addressable) evaluations detailed by 45 CFR 164.308(a)(1) and updated on a periodical bases as part of the required "Periodic Evaluation" process 45 CFR 164.308(a)(8).
In the same process, a "Facility Security Plan" must be addressed regarding maintaining the physical security of the network system that the provider or clearinghouse administers (45 CFR 164.310(a)(1).
All of these evaluations and plans must be documented in either hardcopy or electronic form. Since most health care providers are required by state licensing agencies to maintain "Policy and Procedure Manuals", these documents should be incorperated into the appropriate manuals. It may also be worth considering creating a seperate manual for network security.
I am a student at Montana Tech of the University of Montana majoring in "Information Technology and Design". My background includes being a computer technician (before the advent of chips) followed by 25 years in health care as an EMT and RN. I am obtaining my Bacholor of Science Degree in May of this year, and as part of my Senior Internship project have done an in-depth study of the HIPAA Security Rule relating to network security.
