HIPAA_Data_Recovery_SOP
HIPAA_Data_Recovery_Form
HIPAA Data Recovery Request & Chain of Custody Form
Instructions: Complete all sections. Store completed forms for 6 years per HIPAA retention.
Section 1: Request Details
- Request ID: _______________________________________
- Request Date/Time: _______________________________________
- Requestor Name/Title/Department: _______________________________________
- Contact Info (email/phone): _______________________________________
- Business Justification (clinical/operational impact): _______________________________________
________________________________________________________________
Section 2: Data/System Identification
- System/Application Name: _______________________________________
- Environment (Prod/Test/Dev): _______________________________________
- Data Type(s) (ePHI, PII, other): _______________________________________
- Data Owner: _______________________________________
- Location (server/VM/endpoint/cloud service): _______________________________________
- Asset Tag / Hostname: _______________________________________
Section 3: Recovery Parameters
- Incident/Change Reference #: _______________________________________
- Desired Restore Point (timestamp/snapshot): _______________________________________
- RTO Target (hours): _______________________________________
- RPO Target (minutes/hours): _______________________________________
- Scope (entire system / database / folder / files): _______________________________________
- Dependencies (DB, services, keys, networking): _______________________________________
Section 5: Recovery Execution (to be completed by IT)
- Assigned Engineer: _______________________________________
- Start Date/Time: _______________________________________
- Source Media (backup set ID, snapshot ID): _______________________________________
- Hash/Integrity Verification (method/result): _______________________________________
- Steps Performed (summary):
________________________________________________________________
________________________________________________________________
________________________________________________________________
- End Date/Time: _______________________________________
- Outcome (success/partial/failed): _______________________________________
- Data Validation Results (owner sign-off): _______________________________________
Section 6: Post-Recovery Actions
- Incident Record Updated (yes/no): _______________________________________
- Gaps/Issues Identified: _______________________________________
________________________________________________________________
- Corrective Actions/Follow-ups: _______________________________________
________________________________________________________________
- Runbooks Updated (yes/no/date): _______________________________________
Chain of Custody (if physical media used)
- Media ID: _______________________________________
- Description: _______________________________________
- Custodian Transfer Log (name, date/time, from/to, signature):
| Date/Time | From | To | Signature | Notes |
|_________________|_______________|_______________|________________|___________________|
| | | | | |
| | | | | |
| | | | | |
HIPAA_Data_Recovery_SOP
HIPAA Data Recovery SOP (Printable Checklist)
Purpose: Ensure compliant, timely restoration of ePHI systems (HIPAA 45 CFR §164.308(a)(7)).
Section A: Triage & Authorization
[ ] Validate incident/change request and business impact.
[ ] Confirm data classification and owner; obtain approvals.
Section B: Identify Scope & Restore Point
[ ] Confirm system, dataset, dependencies, and desired timestamp.
[ ] Select backup/snapshot meeting RPO; verify media availability.
Section C: Prepare Environment
[ ] Isolate affected systems if incident-related (malware/ransomware).
[ ] Gather credentials/keys; ensure network and target capacity.
Section D: Execute Recovery
[ ] Follow runbook for system/db/file restore.
[ ] Track actions, timestamps, backup IDs.
Section E: Integrity Validation
[ ] Verify file/system integrity (hashes, DB consistency, app checks).
[ ] Obtain owner validation/sign-off.
Section F: Return to Service
[ ] Reconnect to production networks; monitor performance and logs.
[ ] Validate access controls and audit logging.
Section G: Documentation & Lessons Learned
[ ] Complete Data Recovery Form and attach artifacts (hashes, logs).
[ ] Update runbooks; record corrective actions and test plans.
Sign-Off
- Performed By (print/sign/date): ______________________________________________
- Owner Validation (print/sign/date): __________________________________________
- Security/Privacy Review (print/sign/date): ___________________________________
Records: Retain forms, logs, approvals for 6 years.