EHR Disaster Recovery & Data Backup 3 — Questions and Answers
Question 1: What is the Recovery Point Objective (RPO) in the context of EHR data backup?
- The goal for how quickly systems must be restored after a disaster
- The maximum amount of data loss measured in time that is acceptable (Correct answer)
- The point in physical space where backup media is stored
- The percentage of data that must be recoverable after an incident
Correct answer: The maximum amount of data loss measured in time that is acceptable
RPO defines the maximum acceptable age of data that can be recovered after a failure, essentially determining how frequently backups must be performed.
Question 2: An EHR system at a large health system uses database replication to a secondary site 500 miles away. This strategy primarily addresses which disaster scenario?
- Ransomware attacks from internal users
- Regional disasters such as hurricanes or earthquakes (Correct answer)
- Software bugs causing data corruption
- Unauthorized access to patient records
Correct answer: Regional disasters such as hurricanes or earthquakes
Geographic replication to a distant secondary site protects against regional disasters that could simultaneously affect the primary site and nearby backup locations.
Question 3: Which HIPAA Security Rule implementation specification requires an organization to create and maintain retrievable exact copies of ePHI?
- Access Control
- Data Backup Plan (Correct answer)
- Audit Controls
- Transmission Security
Correct answer: Data Backup Plan
The Data Backup Plan is a required implementation specification under the Contingency Plan standard that mandates organizations establish procedures to create and maintain retrievable exact copies of ePHI.
Question 4: A 'warm site' differs from a 'cold site' in disaster recovery because a warm site:
- Has higher operating temperatures to prevent equipment failure
- Is pre-configured with hardware and connectivity but requires data restoration (Correct answer)
- Automatically fails over without any human intervention
- Stores only non-critical data and systems
Correct answer: Is pre-configured with hardware and connectivity but requires data restoration
A warm site has pre-installed hardware and network infrastructure ready but still requires restoration of recent data backups before operations can resume, making it faster than a cold site but not as immediate as a hot site.
Question 5: During an EHR disaster recovery test, the team discovers the restoration process takes 6 hours, but the RTO is 2 hours. What is the appropriate next step?
- Update the RTO to match the actual restoration time
- Identify and implement improvements to reduce the restoration time (Correct answer)
- Discontinue disaster recovery testing since it disrupts operations
- Switch to a cold site configuration to reduce costs
Correct answer: Identify and implement improvements to reduce the restoration time
When actual recovery time exceeds the RTO, the organization must identify bottlenecks and implement improvements such as faster backup media, better automation, or additional personnel to meet the defined objective.
Question 6: Which encryption requirement applies to EHR backup media that is transported off-site?
- Encryption is optional if the media is in a locked container
- Data must be encrypted to render ePHI unusable if media is lost or stolen (Correct answer)
- Only patient names must be encrypted; other data can remain in plaintext
- Encryption is only required for cloud-based backups, not physical media
Correct answer: Data must be encrypted to render ePHI unusable if media is lost or stolen
HIPAA requires that ePHI on backup media transported off-site be encrypted so that loss or theft of the media does not constitute a reportable breach.
Question 7: What is the purpose of a 'data recovery validation' step after restoring an EHR backup?
- To notify patients that their records were temporarily unavailable
- To confirm that restored data is complete, accurate, and functional (Correct answer)
- To determine who was responsible for the system failure
- To calculate the financial cost of the downtime event
Correct answer: To confirm that restored data is complete, accurate, and functional
Data recovery validation verifies that the restored EHR data is intact, uncorrupted, and operational before returning to full clinical use to ensure patient safety and data integrity.
EHR Disaster Recovery & Data Backup 3
What is the Recovery Point Objective (RPO) in the context of EHR data backup?