How HITECH Impacts Your Emergency Mode Operation Plan

The Health Information Technology for Economic and Clinical Health (HITECH) Act strengthened HIPAA’s Security Rule, emphasizing the need for comprehensive contingency planning, including an Emergency Mode Operation Plan (EMOP). This requirement, outlined under 45 CFR § 164.308(a)(7)(ii)(C), ensures that critical operations and the protection of electronic Protected Health Information (ePHI) continue during emergencies such as natural disasters, cyberattacks, or power outages. For small healthcare practices, HITECH’s enforcement mechanisms and breach notification requirements raise the stakes for maintaining a functional, documented, and tested EMOP.

Emergencies in healthcare are not limited to patient care crises, they also include disruptions that threaten the availability, confidentiality, or integrity of ePHI. A ransomware attack, severe weather event, or extended power failure can halt access to electronic health records (EHRs), disrupt communication, and compromise compliance. The HIPAA Security Rule’s contingency plan standard requires covered entities and business associates to prepare for such situations through an EMOP.

Before HITECH, some practices treated this as an optional policy. Today, the law requires small practices to take it seriously, as failure to maintain an effective EMOP can result in civil penalties, breach notifications, and reputational damage. This guide explains how HITECH reshaped the EMOP requirements and offers practical steps for building and maintaining compliance.

Understanding the Emergency Mode Operation Plan Requirement

Under HIPAA’s Security Rule, the EMOP is part of the Contingency Plan Standard (§ 164.308(a)(7)). It focuses on ensuring that critical business processes remain operational during and after emergencies. The key difference between an EMOP and other contingency measures is that it addresses ongoing operations during an emergency, not just recovery afterward.

Core Components of an EMOP:

1. Identification of Critical Functions – Determining which business processes must remain active.

2. Operational Procedures – Steps for maintaining these functions during a disruption.

3. Access Controls in Emergency Mode – Ensuring that security is maintained even when normal workflows are altered.

4. Communication Protocols – Secure communication between staff, patients, and external entities.

5. Documentation and Review – Keeping a written plan that is regularly updated and tested.

Increased Accountability

HITECH expanded the enforcement authority of the Office for Civil Rights (OCR) and imposed mandatory breach notifications. If a disruption leads to unauthorized access or loss of ePHI, and the EMOP is found inadequate, penalties are far more likely.

Direct Liability for Business Associates

Business associates, such as cloud service providers, must have their own EMOP or integrate with the covered entity’s plan. Contracts (Business Associate Agreements) should explicitly address this responsibility.

Integration with Breach Notification Rule

If an emergency causes a compromise of unsecured ePHI, the incident triggers the HITECH Breach Notification Rule. A strong EMOP can minimize or prevent breaches, potentially avoiding public reporting and patient notifications.

Key Risk Areas for Small Practices

1. Overreliance on IT Vendors
   Many small practices assume that their EHR vendor or IT provider will manage emergency operations. Without a documented understanding, this assumption can leave critical gaps.

2. Outdated Plans
   Plans written years ago may not reflect current systems, threats, or staff roles, creating vulnerabilities during real incidents.

3. Lack of Testing
   Without regular drills or tabletop exercises, staff may be unprepared to implement the plan effectively.

4. Insufficient Cloud Contingencies
   Practices relying on cloud-based systems need explicit offline workflows in case internet access is lost.

Step 1: Conduct a Risk Analysis

Identify threats most likely to disrupt your operations. Consider natural disasters, cyber threats, infrastructure failures, and local hazards. This process is required under § 164.308(a)(1)(ii)(A) and informs all EMOP decisions.

Step 2: Define Critical Business Functions

Document which functions must remain active during an emergency:

• Access to patient treatment information

• Scheduling and communications

• Prescription and lab order capabilities

• Billing processes (if critical for cash flow)

Step 3: Establish Emergency Access Procedures

Per § 164.312(a)(2)(ii), ensure that authorized personnel can access necessary ePHI quickly during emergencies. This may involve:

• Emergency logins

• Temporary role expansions

• Offline backups

Step 4: Create Secure Communication Channels

Use encrypted messaging tools or secure phone lines to coordinate during outages. Avoid personal email or unencrypted messaging apps.

Step 5: Define Recovery Triggers

Specify how and when the practice will transition from emergency mode back to normal operations.

Step 6: Document Vendor Responsibilities

Ensure all relevant business associates have clear obligations for maintaining operations. Incorporate EMOP requirements into BAAs.

Step 7: Train and Test Regularly

Conduct drills at least annually. Rotate scenarios to test different emergency types.

A small practice in the Midwest experienced a severe tornado that knocked out power and internet for several days. The practice’s EMOP, last updated five years prior, lacked current vendor contacts and had no offline patient access plan. Staff resorted to personal devices and paper notes, leading to misplaced patient information and delayed care.

Following the incident, OCR launched a compliance review after a patient complaint. The investigation found that the outdated EMOP failed to meet § 164.308(a)(7)(ii)(C) requirements, resulting in a corrective action plan and a financial settlement.

If the practice had maintained a current EMOP with offline backups, updated contacts, and annual drills, the incident could have been managed without breaching patient trust or attracting regulatory penalties.

• HIPAA Security Rule – 45 CFR § 164.308(a)(7)(ii)(C)

• HITECH Act – Public Law 111-5

• NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems

• HHS Guidance on Contingency Planning and Emergency Mode Operations

• HIPAA Breach Notification Rule – 45 CFR §§ 164.400–414

HITECH raised the importance of the EMOP from a compliance formality to a critical operational safeguard. Small practices should:

• Treat the EMOP as a living document, updated and tested regularly.

• Integrate vendor responsibilities into contracts.

• Train staff, so emergency procedures become second nature.

• Align the EMOP with the broader contingency plan, risk analysis, and breach notification protocols.

A well-prepared EMOP not only protects patients during emergencies but also shields your practice from legal and financial fallout. With HITECH’s increased enforcement powers, proactive planning is no longer optional, it’s essential.

For added assurance, invest in a compliance management tool. These solutions centralize regulatory tracking, provide continuous risk evaluation, and ensure your practice is prepared for audits by addressing weak points before they escalate, reflecting a proactive commitment to compliance.