Overview

Purpose

To develop and implement the capability to backup and reconstitute Information Systems and data within pre-determined time frames in case of a disaster or other event causing an interruption.

Scope and Applicability

This policy applies to Information Systems, facilities, and operations.

Policy Statement

Reasonable and appropriate policies and procedures will be put in place for responding to an emergency or other occurrence that damages Information Systems or facilities containing ePHI or other Sensitive Information.

Procedures

General

1. Executive leadership will be responsible for the development, approval, allocation of resources and prioritization of Contingency Plans and activities.
2. The Development Team is responsible for maintaining the availability of information technology resources identified in the Contingency Plan.
3. The Contingency Plan should be aligned with other emergency plans.
4. Executive Leadership will be responsible for the creation and distribution of messages that will be communicated to the media and other external parties in the event of a disaster or business disruption.
5. All Contingency Planning, emergency operating mode, and recovery procedures should be performed in a way that preserves the safety and health of all AI.io Incorporated Workforce Members and customers.

Business Impact Analysis (BIA) and Data Criticality Analysis (DCA)

1. The relative criticality of specific applications and data shall be assessed in support of other Contingency Plan components.
2. An enterprise-wide Business Impact Analysis (BIA) and Data Criticality Analysis (DCA) shall be conducted to identify, classify, and prioritize its critical business applications, processes, operations and the impacts of downtime in the event of a disaster or other outage.
3. The BIA shall consider interdependencies between processes and departments.
4. The BIA and DCA process will identify current recovery capabilities. Executive leadership will determine the extent that gaps exist between current capabilities and business requirements.
5. BIA and DCA shall be reviewed and updated annually.
6. Significant changes to processes, systems, or resources must be evaluated based on impact to the BIA and DCA.

Data Backup and Retention

1. Procedures shall be established and implemented to create and maintain retrievable, exact, copies of ePHI.
2. Backups should occur at the frequency needed for established recovery objectives.
3. Documented procedures shall be established for backing up data.
4. Retention requirements shall be established.
5. Backup storage media must be protected from unauthorized access.

Emergency Operating Mode and Recovery Plans

1. Procedures shall be established and implemented for obtaining necessary ePHI during an emergency.
2. Procedures shall be established and implemented to enable continuation of critical business processes while operating in emergency mode.
3. Recovery plans must address the full range of critical resources required by the business process including information systems, personnel, workspace, communications, equipment, and interdependencies with other recovery plans.
4. Procedures shall be established and implemented to restore any loss of data.
5. Plans must contain step-by-step recovery procedures containing sufficient detail to ensure a successful recovery outcome regardless of which recovery team members perform them.
6. Plans must be based on the assumption that a disaster event will impact a local geographic area and identify an appropriate planning radius based on the threats for a geographic region.
7. Plans must reflect any applicable emergency plans put in place by local authorities.
8. An alternate geo-redundant site with necessary computing services to meet the objectives of the contingency plans, must be available.
9. Recovery plans must include reporting the status of key recovery activities to Executive leadership.

Review, Training, Testing and Revision

1. Contingency plans must be reviewed and revised as needed and should be updated at least once annually.
2. Training and recovery exercises shall be conducted on an annual basis.

Enforcement & Exception Handling

Failure to comply with this policy, associated procedures and guidelines may result in disciplinary actions up to and including termination of employment or termination of contracts. Legal actions also may be taken for violations of applicable regulations and laws.

Request for exceptions to this policy must be submitted in writing. Prior to official approval of any exception, this policy must continue to be observed.

Definitions

Availability – Means that information is accessible and useable upon demand by an authorized person. Business Impact Analysis – A formal enterprise-wide analysis of the effects of an interruption in business processes caused by a disaster or other major outage.

Contingency Planning – The process of developing an approved set plans and procedures that will enable an organization to respond to an emergency or disaster. This includes the protection of key assets and equipment, and the restoration or maintenance of critical business functions within the agreed-to objectives.

Data Criticality Analysis – A formal enterprise-wide analysis of the criticality, recovery point, and recovery time objectives of each business process. Criticality is determined by identifying the point in time following an interruption that its effects would be unacceptable at the enterprise level. Criticality assessments are made considering factors such as operational and/or financial impacts, loss of stakeholder confidence, and damage to reputation.

ePHI – Protected Health Information that is stored in electronic format.

Information System – Means any combination of information technology and people’s activities that support operational, management and decision making processes. A system normally includes hardware, cloud service, software, information, data, applications, communications, and people.

AI.io Incorporated Workforce Member – Means employees and other persons whose conduct, in the performance of their work, is under the direct control of the organization, whether or not they are paid by the organization. This includes full and part time employees, contractors, affiliates, associates, students, volunteers, and staff from third party entities who provide services.

Distribution

This policy should be distributed to applicable Workforce Members. Recipients of this policy must acknowledge their receipt and understanding of this policy by referring any questions or problems with the policy within ten days of the issue date to the Director of Cybersecurity and Compliance. If no questions or problems are stated, it will be assumed that the policy has been read and understood.

Applicable Regulations