CenterNet
CHS Home CHS Home
OSU-CHS Oklahoma State University
Center for Health Sciences
Security Policies & Proceduress
Printer Friendly
Title: Testing and Revision Policy: SEC 07.04
Category: HIPAA Compliance Authority: 45 CFR §
HIPAA Section: 164.308 (7) (ii) (B)
Standard: Contingency Plan Responsibility: Health Care Components
Effective Date: 04/20/2005 Page 1 of 1
Approved by: OSU Legal Counsel Revised:

Purpose

To specify procedures for periodic testing and revision of contingency plans. Proper testing and revision will serve to continually refine resumption and recovery procedures and reduce the potential for failure.

Policy The Contingency Plan will be maintained routinely and exercised/tested at least annually.
CHS Procedure

Contingency procedures must be tested periodically to ensure the effectiveness of the plan. The scope, objective, and measurement criteria of each exercise will be determined and coordinated by the Contingency Plan Coordinator on a “per event” basis.

There are two categories of testing: announced and unannounced. In an announced test, personnel are instructed when testing will occur, what the objectives of the test are, and what the scenario will be for the test. Announced testing is helpful for the initial test of procedures. It gives teams the time to prepare for the test and allows them to practice their skills. Once the team has had an opportunity to run through the procedures, practice, and coordinate their skills, unannounced testing may be used to test the completeness of the procedures and sharpen the team’s abilities. Unannounced testing consists of testing without prior notification. The use of unannounced testing is extremely helpful in preparing a team for emergency response because it focuses on the adequacy of in-place procedures and the readiness of the team. Unannounced testing, combined with closely monitored restrictions, will help to create a simulated scenario that might exist in an actual contingency operation. This more closely measures the teams’ ability to function under the pressure and limitations of a disaster. Once it has been determined whether a test will be announced or unannounced, the actual objective(s) of the test must be determined. There are several different types of tests that are useful for measuring different objectives.

A recommended schedule for testing is as follows:
  • Desktop testing on a quarterly basis
  • One structured walk-through per year
  • One integrated business operations/information systems exercise per year

Designated HIPAA Officials and other staff at each clinical area will determine end-user participation.

Reference
  • Appropriate Contingency Plans

 

Google
Web CHS Centernet (non-password areas only)
OSU-System | OSU-Stillwater | OSU-OKC | OSU-Tulsa | OSU-Okmulgee | OSU-CHS | Accessibility | Webmaster

Oklahoma State University - Center for Health Sciences
1111 W. 17th St., Tulsa, OK  74107 | 918.582.1972
Copyright © 2007 Oklahoma State University - All rights reserved