EHR Disaster Recovery & Data Backup 5 — Questions and Answers
Question 1: What is the primary goal of a Business Impact Analysis (BIA) in EHR disaster recovery planning?
- To calculate the cost of purchasing backup hardware and software
- To identify critical business functions and quantify the impact of their disruption (Correct answer)
- To document the names of vendors responsible for EHR maintenance
- To train clinical staff on paper-based documentation procedures
Correct answer: To identify critical business functions and quantify the impact of their disruption
A BIA identifies which EHR functions are critical to patient care and operations, determines maximum tolerable downtime for each, and quantifies operational, financial, and clinical impacts of disruption.
Question 2: A healthcare organization discovers that its EHR vendor stores backup data in a different country. Which concern is MOST relevant to HIPAA compliance?
- International backup locations are always prohibited under HIPAA
- The Business Associate Agreement (BAA) must address ePHI protections regardless of location (Correct answer)
- Data encryption is not required for internationally stored backups
- The organization must switch to a domestic-only EHR vendor immediately
Correct answer: The Business Associate Agreement (BAA) must address ePHI protections regardless of location
HIPAA does not prohibit international data storage, but the vendor must sign a BAA that ensures ePHI receives equivalent protections, and the covered entity remains responsible for compliance.
Question 3: Which type of backup creates an exact sector-by-sector image of an entire storage volume, including the operating system and EHR application files?
- File-level backup
- Database dump backup
- Bare-metal backup (system image) (Correct answer)
- Synthetic full backup
Correct answer: Bare-metal backup (system image)
A bare-metal backup captures a complete image of the entire system including the OS, applications, and data, enabling restoration to completely different hardware without reinstalling software.
Question 4: An EHR system experiences a partial database corruption affecting only the scheduling module. Which recovery approach minimizes disruption while preserving data integrity?
- Restore the entire EHR system from the last full backup
- Perform a granular restore of only the affected database tables from the most recent valid backup (Correct answer)
- Shut down the entire EHR until vendors can investigate the corruption
- Manually re-enter all scheduling data from printed reports
Correct answer: Perform a granular restore of only the affected database tables from the most recent valid backup
Granular or object-level restoration allows recovery of specific database components without restoring the entire system, minimizing downtime and avoiding overwriting unaffected data.
Question 5: What role does the 'chain of custody' documentation play in EHR disaster recovery involving backup media?
- It tracks which clinicians accessed patient records during downtime
- It records who handled backup media, when, and where to ensure accountability and integrity (Correct answer)
- It documents the legal chain of liability when a breach occurs during recovery
- It lists the sequence of systems that must be restored in order after a disaster
Correct answer: It records who handled backup media, when, and where to ensure accountability and integrity
Chain of custody documentation for backup media ensures accountability by recording every person who handled the media, transfer dates, and storage locations to detect unauthorized access or tampering.
Question 6: A health system's EHR disaster recovery plan has not been updated in three years. A new cloud-based lab integration was added last year. What is the PRIMARY risk?
- The outdated plan may not address recovery procedures for the new lab integration, creating a gap (Correct answer)
- The plan is still valid since core recovery procedures do not change with new integrations
- Only the vendor is responsible for recovery of cloud-integrated components
- The three-year-old plan automatically expires and must be completely rewritten
Correct answer: The outdated plan may not address recovery procedures for the new lab integration, creating a gap
Disaster recovery plans must be updated whenever significant system changes occur; failing to update the plan after adding a cloud lab integration means staff have no documented procedure to recover that critical component.
Question 7: Which metric best measures the effectiveness of an organization's EHR data backup and recovery program over time?
- The number of backup tapes purchased annually
- Actual recovery time compared to RTO during scheduled tests and real incidents (Correct answer)
- The total size of data backed up per month
- The number of staff members trained on the disaster recovery plan
Correct answer: Actual recovery time compared to RTO during scheduled tests and real incidents
Comparing actual recovery time against the defined RTO during both tests and real incidents provides objective, outcome-based evidence of whether the backup and recovery program achieves its stated goals.
EHR Disaster Recovery & Data Backup 5
What is the primary goal of a Business Impact Analysis (BIA) in EHR disaster recovery planning?