HIPAA backup requirements for medical practices

Last reviewed: October 27, 2026. This guide separates current HIPAA obligations from the proposed Security Rule changes.

What HIPAA currently requires

The contingency-plan standard requires policies and procedures for responding to emergencies or other events that damage systems containing electronic protected health information. Its required implementation specifications include a data backup plan, a disaster recovery plan, and an emergency-mode operations plan. Testing and revision procedures and an application-and-data criticality analysis are currently addressable specifications, which still require a documented, risk-based decision.

What the proposed rule would add

HHS proposes separate technical controls for backing up and recovering ePHI and relevant information systems, more specific restoration expectations, and stronger documentation and testing. The proposal is not final, but it signals that a checkbox saying “we have backups” will not be enough. Practices should be able to demonstrate what is protected, how it is protected, who monitors it, and whether recovery works.

A medical-practice backup inventory

• EHR and practice-management data, including vendor responsibilities
• Scanned documents, shared drives, and cloud file storage
• Email, calendars, and critical contacts
• Clinical images and photography where applicable
• Imaging work lists, interfaces, and configuration data
• Billing, accounting, payroll, and operational files
• Server, network, and workstation configurations needed for recovery
• Encryption keys, licenses, vendor contacts, and recovery instructions

Five questions every administrator should ask

1. What is not covered? A hosted EHR does not automatically protect files stored elsewhere.
2. Can an attacker alter the copies? Keep protected recovery copies beyond the reach of ordinary compromised accounts.
3. Who notices a failure? Automated jobs need monitoring, ownership, and escalation.
4. When was the last restore? Test representative files and systems, then retain the result.
5. How long will recovery take? Compare realistic recovery time with patient-care and business expectations.

Backups do not replace downtime planning

Even a successful recovery takes time. Practices need accessible procedures for schedules, patient communications, clinical documentation, prescriptions, billing, and temporary records while systems are unavailable. Define who makes decisions, how vendors are reached, and how temporary information is reconciled after restoration.

Specialty considerations

Dermatology practices may have clinical images spread across cameras, workstations, mobile devices, and cloud systems. Imaging centers and radiology groups may depend on large studies, specialized workstations, modality connections, remote reading, and multiple vendors. A generic office-file backup does not cover these workflows. Recovery planning must follow how information actually moves through the practice.

Frequently asked questions

Are backups required by HIPAA?

Yes. The current contingency-plan standard includes required data backup and disaster recovery implementation specifications.

Does using a cloud EHR satisfy the backup requirement?

Not automatically. The practice must understand the vendor's responsibilities and identify ePHI and operational information held outside that platform.

How often should recovery be tested?

HIPAA requires a risk-based approach under the current rule. The schedule should reflect criticality, change, contractual requirements, and operational tolerance. Test often enough to find problems before an emergency and document the result.

Sources

• HHS current Security Rule summary
• HHS proposed Security Rule fact sheet
• HHS OCR cybersecurity newsletter: data backup

General educational information only; not legal or compliance advice.