SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-contingency-plan-required

What is a contingency plan in the Security Rule?

A plan to respond to emergencies that damage systems containing ePHI.

Start playing free

  1. Plans for emergencies that damage systems with ePHI ✔
  2. A plan for covering a doctor's patients on vacation
  3. A staffing schedule for flu season

Why: Covered entities must establish and implement as needed policies and procedures for responding to emergencies or other occurrences that damage systems containing ePHI.

Huh, didn't know that: The contingency plan includes data backup, disaster recovery, and emergency mode operation plans.

The dad joke
Why did the contingency plan pack a spare key? To open Plan B.
Like this card?
Play the game

References

Answer: Plans for emergencies that damage systems with ePHI. Covered entities must establish and implement as needed policies and procedures for responding to emergencies or other occurrences that damage systems containing ePHI.

  1. 45 CFR 164.308(a)(7)(i) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
    policies and procedures for responding to an emergency or other occurrence ... that damages systems that contain electronic protected health information
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is electronic protected health information, or ePHI?Work SkillsWho must comply with the HIPAA Security Rule?Work SkillsWhat are administrative safeguards in the HIPAA Security Rule?

That's stuff everyone should know.