EHR Disaster Recovery & Data Backup 4 — Questions and Answers
Question 1: A small medical practice backs up its EHR data nightly to an external hard drive kept in the same office. Which critical disaster recovery risk does this approach fail to address?
- Backup frequency — daily backups are too infrequent for HIPAA compliance
- Geographic separation — a local disaster could destroy both the primary and backup (Correct answer)
- Encryption — external hard drives cannot be encrypted
- Testing — on-site backups cannot be tested for integrity
Correct answer: Geographic separation — a local disaster could destroy both the primary and backup
Storing backups in the same physical location as the primary system creates a single point of failure; a fire, flood, or theft could destroy both the original data and the backup simultaneously.
Question 2: Which of the following BEST describes a 'tabletop exercise' in EHR disaster recovery planning?
- A physical drill where staff practice paper-based charting during simulated downtime
- A discussion-based simulation where staff walk through their roles during a hypothetical disaster (Correct answer)
- A technical test where IT staff actually restore data from backup media
- An annual audit conducted by an external consultant to review backup procedures
Correct answer: A discussion-based simulation where staff walk through their roles during a hypothetical disaster
A tabletop exercise is a discussion-based scenario where key personnel verbally walk through their response to a hypothetical disaster to identify gaps without disrupting live systems.
Question 3: What EHR contingency planning document specifically addresses how to restore systems to normal operations after a disaster has been resolved?
- Disaster Recovery Plan (DRP) (Correct answer)
- Data Backup Plan
- Emergency Mode Operation Plan
- Business Impact Analysis (BIA)
Correct answer: Disaster Recovery Plan (DRP)
The Disaster Recovery Plan outlines the specific procedures and responsibilities for restoring IT systems and data to full operational status following a disaster or disruption.
Question 4: A healthcare organization uses incremental backups daily and full backups weekly. To restore from Tuesday's incremental backup after a Wednesday failure, which backup sets are needed?
- Only Tuesday's incremental backup
- The most recent full backup plus Monday's and Tuesday's incremental backups (Correct answer)
- All incremental backups since the last full backup
- The most recent full backup plus only Tuesday's incremental backup
Correct answer: The most recent full backup plus Monday's and Tuesday's incremental backups
Restoring from incremental backups requires the last full backup plus every incremental backup in sequence since that full backup, because each incremental only contains changes from the previous backup.
Question 5: Under the HIPAA Emergency Mode Operation Plan, what is the primary requirement for covered entities?
- To suspend all EHR operations until systems are fully restored
- To enable continued access to ePHI to support patient care during system failures (Correct answer)
- To notify all patients within 24 hours of any EHR downtime
- To transfer all patients to facilities with functioning EHR systems
Correct answer: To enable continued access to ePHI to support patient care during system failures
The Emergency Mode Operation Plan must ensure that critical business processes that protect ePHI can continue to support patient care even while operating under emergency conditions.
Question 6: A hospital CIO wants to implement the most cost-effective cloud backup solution that still meets a 4-hour RTO. Which approach is MOST appropriate?
- Active-active multi-cloud replication with continuous synchronization
- Cloud-based snapshots taken every 4 hours with documented restoration procedures (Correct answer)
- Tape backup shipped to a cloud storage facility weekly
- On-site SAN replication with manual failover to cloud only if on-site fails
Correct answer: Cloud-based snapshots taken every 4 hours with documented restoration procedures
Cloud snapshots every 4 hours align with the 4-hour RTO; if a failure occurs immediately before a snapshot, the worst-case restoration time still meets the objective while being more cost-effective than active-active replication.
Question 7: Which regulatory framework, in addition to HIPAA, commonly influences EHR disaster recovery requirements for healthcare organizations receiving federal funding?
- PCI-DSS (Payment Card Industry Data Security Standard)
- FISMA (Federal Information Security Modernization Act) (Correct answer)
- SOX (Sarbanes-Oxley Act)
- GDPR (General Data Protection Regulation)
Correct answer: FISMA (Federal Information Security Modernization Act)
FISMA applies to federal agencies and their contractors, including healthcare organizations receiving federal funding, and mandates comprehensive information security programs including contingency planning.
EHR Disaster Recovery & Data Backup 4
A small medical practice backs up its EHR data nightly to an external hard drive kept in the same office.
Which critical disaster recovery risk does this approach fail to address?