East Carolina University
HIPAA Security Standard
Subject: Emergency Mode Operation Plan
Standard #: Standard-0007c
Supersedes:
Effective Date: April 21, 2005
Coverage: ECU Health Care Components
Page: 1 of 2
Approved:
Revised: December 9, 2010,
March 29, 2012, May 30, 2013
Review Date: May 30, 2013
HIPAA Security
Rule Language:
“Establish (and implement as needed) procedures to enable
continuation of critical business processes for protection of the
security of EPHI while operating in emergency mode.”
Regulatory
Reference:
45 CFR 164.308(a)(7)(ii)(C)
I.
PURPOSE
This standard reflects East Carolina University’s commitment to have an Emergency
Mode Operations Plan for protecting its information systems containing EPHI during and
immediately after a crisis situation.
II.
AUTHORIZATION AND ENFORCEMENT
Health Care component management and/or administrator(s) are responsible for
monitoring and enforcing this policy, in consultation with the ECU IT Security Officer,
ECU HIPAA Security Officer, and ECU HIPAA Privacy Officer.
III. STANDARD
ECU Health Care Components must have a formal, documented Emergency Mode
Operation Plan to enable the continuation of crucial business processes that protect the
security of its information systems containing EPHI during and immediately after a crisis
situation. ECU workforce members must receive annual training and awareness on the
Emergency Mode Operations Plan. All appropriate ECU workforce members must have
access to a current copy of the plan and an appropriate number of current copies of the
plan must be kept off-site.
IV. APPLICABILITY
This standard is applicable to all workforce members who are responsible for or
otherwise administer a healthcare computing system. A healthcare computing system is
Copyright 2003 Phoenix Health Systems, Inc.
Limited rights granted to licensee for internal use only. All other rights reserved
Page 1 of 2
HIPAA Security Standard #0007c: Emergency Mode Operation Plan
defined as a device or group of devices that store EPHI which is shared across the
network and accessed by healthcare workers.
V.
PROCEDURE
1. ECU Health Care Components must have a formal, documented Emergency Mode
Operations Plan for protecting its information systems containing EPHI during and
immediately after a crisis situation. At a minimum, the plan must:




Identify and prioritize emergencies that may impact ECU information systems
containing EPHI.
Define procedures for how ECU Health Care Components will respond to
specific emergencies that impact information systems containing EPHI.
Define procedures for how ECU Health Care Components, during and
immediately after a crisis situation, will maintain the processes and controls that
ensure the availability, integrity and confidentiality of EPHI on ECU information
systems.
Define a procedure that ensures that authorized employees can enter ECU
facilities to enable continuation of processes and controls that protect EPHI while
ECU is operating in emergency mode.
2. ECU workforce members must receive annual training and awareness on the
emergency mode operations plan.
3. All appropriate ECU workforce members must have access to current copy of the plan
and an appropriate number of current copies of the plan must be kept off-site.
VI.
COORDINATING INSTRUCTIONS
1. All section policies, standards and procedures will be reviewed annually. Every
section policy, standard and procedure revision/replacement will be maintained for a
minimum of six years from the date of its creation or when it was last in effect,
whichever is later. Other East Carolina University, University of North Carolina
system, or state of North Carolina requirements may stipulate a longer retention
period.
Copyright 2003 Phoenix Health Systems, Inc.
Limited rights granted to licensee for internal use only. All other rights reserved
Page 2 of 2