Technology guide
Backup and HIPAA
Evaluate backup confidentiality, integrity, availability, retention, access, and restoration evidence.
Reviewed August 2026
Key considerations
- Backups can contain complete ePHI and often have broader retention and access than production.
- A successful job is not proof that restoration, keys, dependencies, or business operations work.
- Backup vendors and hosted repositories may be business associates.
Questions to ask
- Are backups isolated from the identity plane and tested for restore?
- Who can access, delete, or alter backup copies?
- What is the retention and disposal process?