SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-data-backup-required

What kind of data backup plan is required under HIPAA?

Procedures to create and maintain retrievable exact copies of ePHI.

Start playing free

  1. Delete old ePHI
  2. Make retrievable exact copies of ePHI ✔
  3. Print paper copies of every chart

Why: The data backup plan must create and maintain retrievable exact copies of ePHI. Backups support recovery after data loss or ransomware.

Huh, didn't know that: Backups should be tested so they can actually be restored when needed.

The dad joke
Why did the backup file get hired? It was exactly what we needed in a crisis: a perfect copy.
Like this card?
Play the game

References

Answer: Make retrievable exact copies of ePHI. The data backup plan must create and maintain retrievable exact copies of ePHI. Backups support recovery after data loss or ransomware.

  1. 45 CFR 164.308(a)(7)(ii)(A) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
    Data backup plan (Required). Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is electronic protected health information, or ePHI?Work SkillsWho must comply with the HIPAA Security Rule?Work SkillsWhat are administrative safeguards in the HIPAA Security Rule?

That's stuff everyone should know.