EHR Disaster Recovery & Data Backup 2 — Questions and Answers
Question 1: What is the primary purpose of a Recovery Time Objective (RTO) in an EHR disaster recovery plan?
- To define the maximum tolerable downtime before restoration must occur (Correct answer)
- To specify the minimum backup frequency required by HIPAA
- To document the cost of data recovery operations
- To identify which staff members are responsible for restoring systems
Correct answer: To define the maximum tolerable downtime before restoration must occur
RTO defines the maximum acceptable time that an EHR system can be offline before the downtime causes unacceptable harm to patient care or business operations.
Question 2: A hospital's EHR system experiences a ransomware attack that encrypts patient data. Which backup type would be MOST effective for rapid recovery with minimal data loss?
- Weekly full backups stored off-site
- Daily incremental backups to tape
- Continuous data protection (CDP) with off-site replication (Correct answer)
- Monthly differential backups to local storage
Correct answer: Continuous data protection (CDP) with off-site replication
Continuous data protection captures every change in near-real-time, minimizing data loss and enabling rapid recovery to a point just before the attack.
Question 3: Under HIPAA Security Rule, covered entities must test their contingency plans at what minimum frequency?
- Monthly
- Periodically, as specified in their own policies (Correct answer)
- Annually, mandated by federal law
- Every two years
Correct answer: Periodically, as specified in their own policies
HIPAA requires covered entities to implement testing and revision procedures but allows organizations to define the specific frequency based on their risk assessment.
Question 4: What does the term 'hot site' refer to in EHR disaster recovery planning?
- A backup data center with current data and systems ready for immediate failover (Correct answer)
- A location where paper records are stored during outages
- A server room with elevated temperature tolerances
- A remote access portal for clinicians during downtime
Correct answer: A backup data center with current data and systems ready for immediate failover
A hot site is a fully operational backup facility with replicated data and systems that can assume operations with minimal or no delay.
Question 5: Which backup strategy stores only the data that has changed since the last FULL backup?
- Incremental backup
- Differential backup (Correct answer)
- Mirror backup
- Snapshot backup
Correct answer: Differential backup
A differential backup captures all changes since the last full backup, which means each differential grows larger but restoration requires only the last full plus the last differential.
Question 6: A clinic implements a 3-2-1 backup rule for its EHR system. What does this rule specify?
- 3 daily backups, 2 weekly backups, 1 monthly backup
- 3 copies of data, on 2 different media types, with 1 copy off-site (Correct answer)
- 3 staff members authorized for recovery, 2 backup servers, 1 cloud provider
- 3-minute RTO, 2-hour RPO, 1 backup administrator
Correct answer: 3 copies of data, on 2 different media types, with 1 copy off-site
The 3-2-1 rule recommends maintaining 3 copies of data stored on 2 different media types with at least 1 copy kept off-site to protect against local disasters.
Question 7: During an EHR downtime event, which document guides clinical staff on how to continue providing care without electronic access?
- Business Continuity Plan (BCP)
- Downtime Procedures Manual (Correct answer)
- System Security Plan (SSP)
- Data Use Agreement (DUA)
Correct answer: Downtime Procedures Manual
A Downtime Procedures Manual provides step-by-step instructions for clinical workflows, including paper-based documentation and manual medication reconciliation, when the EHR is unavailable.
EHR Disaster Recovery & Data Backup 2
What is the primary purpose of a Recovery Time Objective (RTO) in an EHR disaster recovery plan?