Disaster Recovery Plan (DRP)
Disaster Recovery Plan
The portion of the contingency plan that addresses restoration of IT systems and ePHI after a disruptive event.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- Security
- Acronym for
- Disaster Recovery Plan
- Primary sources
- 2
- Workspace handoff
- compliance binder →
Where this comes up
This sits inside the security risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — workstation controls, EHR access roles, ePHI transmission encryption, audit logging, vendor risk, and incident response. Reviewers expect dated evidence of the control, not a policy PDF that says it exists.
Full definition
What it is in practice
45 CFR 164.308(a)(7)(ii)(B) requires a disaster recovery plan. NIST SP 800-66 Rev. 2 ties DRP to the broader business continuity framework.
How it shows up in your practice
Test the DRP periodically. Document RTO (recovery time objective) and RPO (recovery point objective) by application.
Sources
- 45 CFR 164.308 — Administrative safeguardshttps://www.ecfr.gov/current/title-45/section-164.308
- NIST SP 800-66 Rev. 2https://csrc.nist.gov/pubs/sp/800/66/r2/final
Document the DRP in the Compliance Binder
Open compliance binder →Related terms
- SecurityContingency PlanThe HIPAA-required plan covering data backup, disaster recovery, and emergency-mode operation when normal operations are disrupted.
- SecurityBackup and RecoveryProcedures to create and maintain retrievable exact copies of ePHI and to restore data and systems after a disruption.
- SecurityIncident Response PlanThe documented plan describing how a covered entity detects, contains, eradicates, and recovers from a security incident.
- SecurityBusiness Continuity Plan (BCP)The plan that enables continued business operations during and after a disruption.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryBackup and RecoveryProcedures to create and maintain retrievable exact copies of ePHI and to restore data and systems after a disruption.
- GlossaryBusiness Continuity Plan (BCP)The plan that enables continued business operations during and after a disruption.
- GlossaryContingency PlanThe HIPAA-required plan covering data backup, disaster recovery, and emergency-mode operation when normal operations are disrupted.
- GlossaryIncident Response PlanThe documented plan describing how a covered entity detects, contains, eradicates, and recovers from a security incident.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
- SRAHIPAA Contingency Plan for a Small PracticeWhat the Security Rule contingency plan standard at 45 CFR 164.308(a)(7) actually requires, including data backup, disaster recovery, emergency mode operation, and testing — for a small practice.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.