Description: 

164.308(a)(7)(i) - Contingency Plan - Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (As one illustrative example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.


Audit: 

The customer is responsible for creating a contingency plan that appropriately incorporates all aspects of their AWS use case (e.g. for backing up and restoring ePHI), and which address situations such as a potential lack of availability of ePHI on AWS.

To address organizational requirements related to major regional disasters, AWS supports the ability to place data in multiple geographic regions, and multiple AWS Availability Zones (AZs) within each region. AZs consist of one or more discrete data centers, each with redundant power, networking and connectivity, housed in separate facilities. These AZs offer the ability to operate production applications and databases which are more highly available, fault tolerant and scalable than would be possible from a single data center.

The customer is responsible for modifying this architecture to employ additional AWS regions and AZs, and to implement cross-region data synchronization, load balancing, etc.


Rationale: 

"This architecture incorporates multiple AWS Availability Zones (AZs) and Amazon S3 storage, which are elemental to organizational plans for transfer of processing and storage to alternate sites, because this architecture constitutes a built-in alternate storage and processing capability that dynamically provides transfer and resumption of system operations in the event of failures due to fire, vandalism, hardware malfunctions, network/power outages, or a small area natural disaster.


Impact of Resource Type(s):

AWS::EC2::AvailabilityZone

AWS::AutoScaling::AutoScalingGroup

AWS::RDS::DBSubnetGroup

AWS::RDS::DBInstance

AWS::S3::Bucket

AWS::EC2::Subnet


References: 

https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/nist80066.pdf