HIPAA contingency plan template for dental practices

This template is general information, not legal advice, and it is a starting point: it does not make a practice compliant by being filled in. The explanation behind each part is on the contingency plan standard, explained. To keep a paper copy, print this page from your browser.

How to use this template

1. List every system that holds patient information. Fill in the criticality worksheet with each system: practice management, imaging, documents and scanned forms, claims and clearinghouse access, email, and phones or fax if they are electronic.
2. Rank the systems by how much the practice depends on them. Give each system a rank and a restore target that you set. This ranking decides the restore order in step 4.
3. Write the data backup plan. For each system, record what is copied, how often, where the copies are kept, who checks them and how they are checked.
4. Write the restore procedure and order. Record the order in which systems are restored, who does each step, and where the access details are kept.
5. Write the emergency mode procedures. Decide how the practice keeps seeing patients and protecting patient information while systems are down, and who authorises emergency mode.
6. Schedule and record restore tests. Set how often you test restores on separate hardware, and use the testing log to record what was restored, the result and any follow-up.
7. List vendors and the agreements on file. Record each vendor that maintains patient information for the practice, how to reach them after hours, and where the signed agreement is.
8. Approve, store and review the plan. Have the plan approved, keep it where the people who need it can reach it, and review it whenever your systems, staff or vendors change.

1. Plan details

Practice
Plan owner (name and role)
Version and date
Approved by, and date
Next scheduled review

2. Criticality worksheet

Rank each system by how much the practice depends on it (for example 1 = restore first, 2 = restore next, 3 = when possible) and set a restore target for it. The regulation requires the assessment, not particular answers.

System	Patient information it holds	Rank	Restore target (set by you)
Practice management
Imaging
Documents and scanned forms
Claims and clearinghouse access
Email
Phones and fax (if electronic)

3. Data backup plan

System	What is copied	How often	Where the copies are kept (on site, off site)	Who checks them, and how
Practice management
Imaging
Documents and scanned forms
Claims and clearinghouse access
Email
Phones and fax (if electronic)

4. Disaster recovery: restore order and roles

Step	System	Who does it	What they need, and where it is kept	How we know it worked
1
2
3
4
5
6

5. Emergency mode operation

How the practice keeps working, and keeps patient information protected, while systems are down.

• ☐ Printed charting and medical-history forms are stocked at: ________________
• ☐ A printed copy of the day’s schedule is produced by ________________ at ________________
• ☐ Phones are forwarded to ________________ by ________________
• ☐ Patients are told by ________________ using ________________
• ☐ Staff are told by ________________ using ________________
• ☐ Paper containing patient information is kept in ________________ and handled only by ________________
• ☐ Paper records are re-entered by ________________ and then ________________
• ☐ Emergency mode is declared by ________________ and ended by ________________

6. Testing and revision log

Restore to separate hardware, never over the live system. Our schedule: ________________

Date	System	What was restored, and to where	Result	Who	Follow-up and plan changes

7. Vendors and agreements

Vendor and role	Service	Contact and after-hours number	Written agreement on file (where, and date)

Keep the contact list somewhere that does not depend on the systems it is for. Why the written agreements matter, and what the regulation says about them, is covered in does your backup provider need a BAA.

8. Where this plan is kept, and for how long

Where the plan is stored: ________________. Who can reach it in an emergency: ________________. The regulation sets the retention period:

(i) Time limit (Required). Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.¹

9. Revision history

Version	Date	What changed and why	Approved by

Sources

1. 45 CFR 164.316(b)(2)(i) (eCFR, accessed 2026-10-06)