Are there federal requirements that define your backup methodology?

• A. True
• B. Sometimes
• C. Not applicable
• D. False

Answer: (D)

The idea here is that federal regulations require you to plan for data backup and recovery, but they don’t specify the exact backup method you must use. HIPAA’s security rule requires a contingency plan that includes a data backup plan and a disaster recovery plan, and these plans must be tested and capable of restoring ePHI. However, the rule does not prescribe how backups should be performed—whether you use full or incremental backups, on-site or off-site storage, encryption standards, or particular technologies is up to your organization, guided by your risk assessment and business needs. So while backups are required, the federal requirements do not define the backup methodology, making the statement false.