HIPAA Security Data Management and Backup

Layout for printing
Policy Number:
UW-134
Old Policy Number:
8.11
Responsible Office:
Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards.

Definitions:
Backup
The process of making an electronic copy of data stored in a computer system. Examples of backups include:
  • Full/Complete backup – a backup/image of all (selected) data, programs, files on the system.
  • Incremental backup – a backup that only contains the files that have changed since the most recent backup (either full or incremental).
  • Snapshot backup (image backup) – a process to restore/recover the system at a particular state, at a particular point in time.
  • In the event a system does not allow for an electronic backup, the unit will develop an alternative method to create a copy of the electronic protected health information (ePHI) contained on that system.
Business associate
A person or entity that performs or assists in performing, for or on behalf of a covered entity, business support functions/services that involve the use of protected health information (PHI).
Electronic protected health information (ePHI)
Any individually identifiable health information protected by HIPAA that is transmitted by or stored in electronic media.
Protected health information (PHI)
Health information or health care payment information, including demographic information collected from an individual, which identifies the individual or can be used to identify the individual. Protected health information does not include student records held by educational institutions or employment records held by employers.
UW–Madison health care component (UW HCC)
Those units of UW–Madison that have been designated by the university as part of its health care component under HIPAA. See UW-100 Designation of UW–Madison Health Care Component for a listing of these units.
Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

  1. It is the policy of UW–Madison that the units of the UW HCC and each individual or unit within UW–Madison that is a business associate of a covered entity (hereafter collectively referred to as “units”) will protect the confidentiality, integrity, and availability of electronic protected health information by implementing sound data management and backup practices that include, but are not limited to, the activities described in this policy below.
  2. The unit establishes and implements procedures to create and maintain retrievable exact backup copies of electronic protected health information as required by 45 CFR § 164.308(a)(7)(ii)(A) (HIPAA Security Rule – Contingency Plan – Data Backup Plan). The procedures will assure that complete, accurate, retrievable, and tested backups are available for all electronic protected health information on all information systems used by the unit, with the following exceptions:
    1. Additional copies of electronic protected health information created for convenience do not need to be backed up, provided that the original copy is properly backed up and available as required by the HIPAA Security Rule.
    2. Data sets containing electronic protected health information that were generated from other data sets do not need to be backed up, provided that the original data sets containing electronic protected health information are properly backed up and available as required by the HIPAA Security Rule, and it is possible to recreate enough of the generated data set in a timely manner so that electronic protected health information in the generated data set is available as required by the HIPAA Security Rule.
  3. The unit creates a retrievable exact backup copy of electronic protected health information before movement of equipment as required by 45 CFR § 164.310(d)(2)(iv) (HIPAA Security Rule – Device and Media Controls – Data Backup and Storage). The same exceptions listed in II. apply.
  4. The unit maintains a record of movements of hardware and electronic media containing electronic protected health information and any person responsible for such movements, as required by 45 CFR § 164.310(d)(2)(iii) (HIPAA Security Rule – Device and Media Controls – Accountability).
  5. The unit creates and stores backup copies in accordance with their safeguard implementation plan (or the equivalent) as described in UW-124 HIPAA Security Risk Management. The unit creates backup copies at a sufficient frequency and retains them in safe locations for a sufficient length of time to accomplish all of the following:
    1. Data backups that enable the restoration of electronic protected health information that is lost or corrupted.
    2. Data backups that support the unit’s disaster recovery plan (or the equivalent) as required by 45 CFR § 164.308(a)(7)(ii)(B) (HIPAA Security Rule – Contingency Plan – Disaster Recovery Plan) and as described in UW-127 HIPAA Security Contingency Planning.
    3. Data backups that support the unit’s emergency mode operations plan (or the equivalent) as required by 45 CFR § 164.308(a)(7)(ii)(C) (HIPAA Security Rule – Contingency Plan – Emergency Mode Operations Plan) and as described in UW-127 HIPAA Security Contingency Planning.
    4. Data backups that support the unit’s mechanisms to authenticate electronic protected health information, as required by 45 CFR § 164.312(c)(2) (HIPAA Security Rule – Integrity – Mechanism to Authenticate Electronic Protected Health Information) and as described in UW-126 HIPAA Security Auditing.
  6. Data backups will be tested according to the requirements of 45 CFR § 164.308(a)(7)(ii)(D) (HIPAA Security Rule – Contingency Plan – Testing and Revision Procedures) as described in UW-127 HIPAA Security Contingency Planning.
  7. Responsibility for compliance with this policy in specific circumstances will be assigned in the unit’s safeguard implementation plan (or the equivalent) as described in UW-124 HIPAA Security Risk Management.

Policy Detail

  1. Data Backup

    1. The UW–Madison HIPAA security officer has oversight responsibility and the security officer or delegate will work with each unit’s HIPAA security coordinator to ensure that responsibility is further assigned within the unit.
    2. A backup, recovery, and testing strategy should be determined based upon the unit’s safeguard implementation plan (or the equivalent) as described in UW-124 HIPAA Security Risk Management.
    3. The following is typical of backup arrangements, and can be used as a template for variation:
      1. A typical arrangement includes a daily backup of data that has changed on all systems that create, receive, maintain, or transmit electronic protected health information.
      2. Data backup systems may be manual or automated. Automated systems electronically capture backup locations, date/time, etc. If the process is manual, documentation of the backup should include:
        1. Site/location name.
        2. Name of the system.
        3. Type of data.
        4. Date and time of backup.
        5. Where backup is stored (or to whom it was provided).
        6. Signature of individual that completed the backup.
    4. Stored backups must be sufficiently accessible and retrievable to meet the specifications of the unit’s continuity of operations plan (or the equivalent) as described in UW-127 HIPAA Security Contingency Planning.
    5. All media used for backing up electronic protected health information must be stored in a physically secure environment, such as a secure, off-site storage facility or, if backup media remains on-site, in a physically secure location, different from the location of the computer systems it backed up (i.e., in a location that protects the backups from loss or environmental damage).
    6. If an off-site storage facility or backup service is used, a business associate agreement must be used to ensure that the business associate will safeguard the electronic protected health information in an appropriate manner. A business associate agreement might not be needed for off-site storage or backup services at certain UW–Madison facilities. This will need to be evaluated on a case-by-case basis by the UW–Madison HIPAA privacy officer and the UW–Madison HIPAA security officer.
    7. When reusable media such as tapes are used as the backup media, refer to  UW-130 Destruction/Disposal of Protected Health Information and UW-505 Media and Device Disposal and Reuse.
    8. Data backups should be tested and data restored, to ensure accuracy. Documentation of backup testing, or restore logs, should be maintained and should capture the date and time the data was restored. Operational procedures for backup, recovery, and testing should be documented and periodically reviewed.
    9. Proper management of situations concerning data backup and data recovery, such as emergencies or other occurrences, should be addressed in the unit’s continuity of operations plan (or the equivalent) as described in UW-127 HIPAA Security Contingency Planning.

  2. Destruction

    1. The unit will determine an appropriate schedule for the retention of data backups. This schedule should include a timeline for the ultimate destruction of reusable storage media.
    2. Refer to UW-130 Destruction/Disposal of Protected Health Information and UW-505 Media and Device Disposal and Reuse when records are disposed of, or storage media containing electronic protected health information is re-used or disposed of.

  3. Media Handling

    1. It is not possible or economically practical to control all media that enter and leave an organization; however, the unit will make reasonable and prudent efforts to control media entering and leaving the organization.
    2. Media that contains protected health information that is no longer useful or useable should be sanitized or disposed of consistent with UW-130 Destruction/Disposal of Protected Health Information and UW-505 Media and Device Disposal and Reuse.

  4. Sanctions

    1. Failure to backup a system in the absence of a system failure is a violation of this policy.
    2. Violation of this policy and its procedures by workforce members may result in sanctions as described in UW-138 Responding to Employee Noncompliance with Policies and Procedures Relating to the HIPAA Privacy and Security Rules.
    3. Violation of the policy and procedures by others, including providers, providers' offices, business associates, and partners may result in termination of the relationship and/or associated privileges.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:
External References:

Policy Administration

Approval Authority:
Vice Chancellor for Legal Affairs
Policy Manager:
HIPAA Security Officer
Contact:
HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077
Effective Date:
06-09-2015
Revised Dates:

02-12-2015: Effective date of the revised policy: 02-12-2015.
03-26-2020: Effective date of the revised policy: 03-26-2020.

Retrieved:
01-14-2025 18:28:09