Implement Data Backup and Recovery

[suhasramanand]

Establish and implement procedures to create and maintain retrievable exact copies of ePHI.

Acceptance criteria

• Daily incremental backups
• Weekly full backups
• Offsite backup storage required
• Backup encryption required (AES-256)
• Recovery Point Objective (RPO): Maximum 24 hours
• Recovery Time Objective (RTO): Maximum 4 hours

---

Source: § 2.3.2

Covered entities MUST establish and implement procedures to create and maintain retrievable exact copies of ePHI.