164.310(a)(2)(i) Contingency operations: requirements and evidence

What contingency operations asks for when the building is the problem

Contingency operations asks you to prove that authorized people can get into the right rooms during an emergency, so that lost ePHI can be restored. Under 45 CFR 164.310(a)(2)(i), a covered entity or business associate needs documented procedures that allow facility access in support of restoring data under the disaster recovery plan and running the emergency mode operation plan. The specification is addressable, not required. Under 45 CFR 164.306(d)(3), you must first assess whether it is reasonable and appropriate for your facility. If it is, you implement it. If it is not, you document why and adopt an equivalent alternative measure, if one is reasonable and appropriate. Either way, the assessor will expect that decision to be written down and traceable to your risk analysis.

The specification ties the physical side of the Security Rule to the planning required by 45 CFR 164.308(a)(7)(ii)(B) and (C). Your disaster recovery and emergency mode operation plans are only as good as the people and hardware able to carry them out. A restoration team that cannot enter the data center, a recovery engineer locked out of the network closet, or a generator room that requires a card reader with no backup power all make the written plan unworkable. Confirm with your security official and facilities lead which roles must enter which spaces during an outage, who may authorize emergency entry, and how that authority is recorded when the usual approval chain is down.

This is hard in practice for three reasons. After-hours access often depends on a badge system whose controller, network path and door locks sit on the same power and network that failed. Emergency access is frequently granted by someone who is off site, unreachable or not named in any procedure. And the people who would need to enter may not be the people who hold keys or badges. A practical check is to run a tabletop exercise in which a named restoration engineer must reach the server room at 2 a.m. with primary power and the badge system down. Record what fails, who decides, and what evidence exists afterward. That record is what turns the procedure into evidence.

Which facilities, systems, people and vendors fall under contingency access

Contingency operations only matter for the places where ePHI is stored, processed or restored. The decisions below determine which sites, equipment, staff and outside parties need a documented path in during an emergency, and they should be settled before the disaster recovery and emergency mode operation plans are written.

Data centers and server rooms

These hold the systems that store and process ePHI, so they are the first place a restoration team will need to enter after a disaster. Identify every room that houses an ePHI server, storage array, backup appliance or network core, and record who can reach each one when badge systems, power or building access are down. Check whether the access procedure covers the hours when the on-call engineer is the only person available, not just the business day.

Offices holding workstations

Clinical and administrative offices often contain workstations that display ePHI, and staff may need to reach those rooms to keep operations running during an outage. List each office, floor or clinic that has ePHI-bearing workstations, and decide whether emergency entry is limited to named roles. Confirm that the same procedure also covers the storage of paper records and portable devices kept in those rooms.

Colocation and cloud-adjacent sites

When racks sit in a colocation facility, the emergency access path depends on the provider's own procedures, not only yours. Ask the provider how it verifies identity for emergency entry, how it notifies you when access is granted, and whether it will admit your restoration staff or a named contractor during a regional event. Where cloud-adjacent equipment such as on-premises gateways is located in a third-party building, record that dependency in the plan.

Third-party recovery staff

Outside engineers, forensic firms and managed service providers may need physical access to restore systems, and each adds a person who must be verified in an emergency. Decide in advance which contractors are named in the plan, what identity checks apply, how long their access lasts and who escorts them. Confirm these terms in the business associate agreement and the vendor's own contingency documentation, so that the access path is not improvised during an incident.

Named emergency access roles

Emergency entry should be granted to roles, not to whoever happens to be nearby. Define which internal positions, such as the security official, facilities lead, IT on-call engineer and disaster recovery coordinator, can authorize or perform emergency entry, and keep a current roster with backup names for each. Review the roster whenever staff change, and test whether a designated person can actually reach the site when the primary person is unavailable.

Alignment with the emergency plans

The access procedure must match the disaster recovery plan and emergency mode operation plan required under 45 CFR 164.308(a)(7), because those plans define what must be restored and in what order. Map each facility and role to a recovery step, so that a restoration task never depends on a door that no one is authorized to open. Confirm with the organization's own counsel and compliance lead how the required plans and this addressable specification are documented together.

How an assessor tests emergency facility access

This table walks through the four things an assessor typically does to test 164.310(a)(2)(i), what evidence each step asks for, and where organizations most often fall short. Read it as a checklist for your own readiness review before an OCR audit or a customer assessment. The main takeaway is that the addressable status and the emergency access procedure must be documented and tested, not just written down.

Assessor step	What the assessor checks	Evidence requested	Common finding
Read the plans	Whether the disaster recovery plan and emergency mode operation plan under 164.308(a)(7) name who may enter the facility, and under what conditions, to restore lost data	Current disaster recovery plan, emergency mode operation plan, version history and approval records	Plans exist but say nothing about physical access to the facility or data center
Check the access procedures	Whether written facility access procedures exist for emergencies and match what the plans require	Emergency access procedure, badge or key override steps, named roles with after-hours authority	Procedure describes normal badge access only, with no emergency override path
Confirm the addressable decision	Whether the organization assessed the specification as reasonable and appropriate and documented the result	Signed risk assessment entry, decision record, and any equivalent alternative measure	No documented decision on the addressable status, or the decision was never revisited
Walk through a tabletop scenario	Whether staff can get authorized people into the facility to recover data during a stated outage, such as a flood, fire or site loss	Scenario script, attendee list, timed actions, and the gaps the team recorded	Staff describe an access path that depends on a system that the scenario would take offline
Review outage and drill records	Whether past incidents or drills show that emergency access worked and that problems were fixed	Drill reports, outage post-incident reviews, corrective action tracking with closure dates	Drills were run but never tested physical entry, or findings were logged without follow-up
Test dependencies	Whether access controls still work when power, network, badge servers or identity services are down	Architecture notes, backup power and offline credential procedures, vendor support contacts	Electronic badge readers have no offline fallback, and the emergency key holders are not listed
Check consistency with other safeguards	Whether emergency access aligns with the facility security plan and access validation procedures	Facility security plan, access logs from drills, visitor logs for emergency entries	Emergency entry is logged on paper only, so the organization cannot show who entered

Steps to build emergency access procedures that hold up

This sequence turns the contingency operations addressable specification into written, tested procedures that let authorized staff reach facilities and equipment during an emergency to restore lost ePHI. Each step produces a record an auditor can follow from the disaster recovery plan to the test results.

Confirm the disaster recovery and emergency mode plans
Start by pulling the current disaster recovery plan and emergency mode operation plan, the two plans that 45 CFR 164.308(a)(7) requires. The contingency operations procedure has no purpose unless these plans name the systems, data sets and recovery sites that someone will need physical access to. The compliance lead or security official should confirm that each plan lists the facilities, server rooms and equipment in scope, and that the owner of each plan has signed off. The output is a short mapping of which facilities a recovery depends on.
Assess whether emergency facility access is appropriate
Under 45 CFR 164.306(d), contingency operations is addressable, so the organization must decide whether emergency facility access is reasonable and appropriate for its environment. Ask whether the recovery plan can be carried out without entering a facility, for example through cloud-hosted backups or a remote recovery site. If access is needed, the assessment should say so and explain why. Record the decision, the reasoning and the people who approved it. If the answer is that access is not appropriate, document that and identify the equivalent alternative measure.
Define who may enter and under what authority
Name the roles that may enter a facility during an emergency, such as on-call infrastructure staff, a designated recovery lead or an approved vendor technician. For each role, state the trigger that activates emergency access, the person who declares it and how the declaration is communicated. Define how identity is confirmed when normal badge systems are unavailable, and how access is logged and reviewed afterward. Vendors must be covered by the business associate arrangements that apply to them. The output is a roster of roles, triggers and approvers that the access validation procedures can reference.
Set offline or manual fallbacks for access systems
Badge readers, electronic locks and access control servers can fail with the same event that requires recovery. Document how doors open if the system is down, such as a manual override, a sealed key custodian process or a staffed entry point. Confirm with the facility and the access control vendor how these fallbacks work, whether battery backup or local controllers keep doors functional, and what the vendor's documentation says about failure modes. Store the physical keys or override credentials under dual control. The output is a fallback procedure with a named custodian for each override method.
Test the emergency access procedure
Run a test in which the designated staff follow the emergency access procedure without relying on the normal badge system, then complete one restoration step on a non-production copy of the data. Record who attempted entry, which fallback was used, how long each step took in the test and any step that failed. Ask a second person to observe and note gaps. Testing should involve the vendors and facility staff named in the roster, since a fallback that only the security team knows about will not work during a real event. The output is a test record with findings and owners for each fix.
Record the output and keep it current
Collect the outputs of each earlier step into one controlled document set: the plan mapping, the appropriateness decision, the role roster, the fallback procedure and the test record. Assign an owner and a review trigger, such as a change to the facility, the access system or the recovery plans. Store the documents where the security official and auditors can retrieve them, and retain them under the documentation requirements in 45 CFR 164.316. The output is a version-controlled evidence package that shows the procedure was designed, assessed, tested and maintained.

Documenting why an addressable specification is or is not reasonable

Contingency operations is addressable, so the organization must decide for itself whether emergency facility access is reasonable and appropriate, and record that decision. Under 45 CFR 164.306(d)(3), the choice has three branches. If the procedure is reasonable and appropriate, you implement it. If it is not, you document why and then implement an equivalent alternative measure, provided that measure is reasonable and appropriate. Leaving the question unanswered is not an option, because an assessor will look for evidence that someone weighed the specification at all. The decision belongs to the covered entity or business associate. Neither HHS nor an outside consultant makes it for you, and a consultant can only advise on the reasoning you adopt. A practical record for this specification starts with the disaster recovery plan and the emergency mode operation plan required by 164.308(a)(7)(ii)(B) and (C). Write down which facilities hold ePHI systems, backup media or the staff who restore data, and what the recovery plan requires physically at each one, such as access for a vendor engineer after hours or a credentialed restore team entering a data hall during a flood. For each facility, record the decision (implement or not), the reasoning in plain terms, the named owner who approved it, and the date. If the answer is no, the record must name the equivalent measure, such as pre-approved remote restoration from an offsite replica, or a standing arrangement with a hosting provider that holds keys and logs its own access. Then test whether that measure would really restore data within the recovery objectives you set. Review the record when the facility, the recovery plan or the hosting arrangement changes, and whenever a drill or incident shows the reasoning no longer holds. Ask your reviewers to confirm that the owner named in the record is still in post and that the alternative measure is still in operation, since an alternative that exists only on paper will not satisfy an assessor. Illustrative example: a regional clinic that relies on a single server room may decide emergency access is reasonable and write the after-hours entry procedure into its plan, while a multi-site provider may document why a single on-call engineer with remote access is an equivalent measure for its colocated facilities. Confirm the specifics against your own environment and counsel's view before you rely on either.

Evidence that passes a contingency operations review

A contingency operations review checks whether emergency facility access was planned, documented and tested before an emergency happened. The artifacts below connect the facility access controls to the disaster recovery and emergency mode operation plans, so an assessor can follow one decision from the plan to the drill record.

Written emergency access procedure

This is the document that says who may enter which facilities during an emergency, how that access is requested and approved, and how it is logged while it lasts. It should name the facilities that house ePHI systems and the people or roles that can authorize entry. Check that the procedure states when it activates, who can invoke it, and how it ends, so the reviewer can see a clear path from declaration to restored normal access.

Linked disaster recovery and emergency mode plans

The emergency access procedure only works if it points to the contingency plans it supports. The reviewer will look for explicit references to the disaster recovery plan and the emergency mode operation plan required under 164.308(a)(7), and for matching names, versions and owners. Confirm that each plan lists the physical access steps it depends on, and that no plan describes a facility as reachable when the access procedure says otherwise.

Access role register

A register lists each role allowed emergency entry, the facilities and equipment it covers, and the business reason for each grant. It should be kept under change control, with a named owner who reviews it on a fixed schedule and after staffing changes. Check that every entry traces to a current employee, contractor or vendor, and that vendor entries have an end date tied to the engagement.

Fallback and manual override records

When badge readers, electronic locks or building management systems fail during an emergency, staff use manual overrides such as key control or a documented override code. Keep a log of each override showing the time, the person, the reason and the approver. Check that the key and code inventories are reconciled against the register, since an override that cannot be traced to an authorized role is the finding reviewers are most likely to record.

Drill and tabletop reports

Reports from exercises show that the procedure works in practice. Each report should record the date, the scenario, the participants, the facilities involved, the steps tested and the findings with owners and due dates. The reviewer will check whether findings from earlier exercises were closed before the next one. Ask your team to confirm that exercises cover both a full facility loss and a partial access failure, since each tests different steps.

Addressable decision record

Because 164.310(a)(2)(i) is addressable, the file must show that the organization assessed whether it is reasonable and appropriate to implement. If it is not, the record should explain why and name the equivalent alternative measure. Review the decision each time the facility, the workforce or the contingency plans change, and confirm the record is dated and signed by the person accountable for the decision.

What meeting contingency operations costs in money and effort

This table breaks down the cost of meeting 164.310(a)(2)(i) by component, showing who is paid, whether the cost is one-time or recurring, and what moves it up or down. No dollar figures or durations are given because none are supplied for this requirement, so use the right-hand column to build the questions you put to any quote. The main takeaway is that most of the cost sits in keeping emergency access procedures current and tested, not in writing them once.

Cost component	One-time or recurring	What drives it up or down	What to request in a quote
Procedure writing and review	One-time, then periodic review	Number of facilities, sites and data centers in scope; how many emergency modes the disaster recovery and emergency mode operation plans already cover	Itemized deliverables per site, the review cycle, and whether the procedure is tied to existing plans under 164.308(a)(7)
Access role and fallback setup	One-time build, recurring upkeep	Whether badge systems support offline or manual override; number of roles that need emergency entry; vendor-hosted versus on-premises access control	Written list of fallback methods (manual override, offline credential list, escorted entry), who holds each, and how changes are logged
Emergency access list maintenance	Recurring	Staff turnover, contractor churn, and how often facilities or tenants change	Frequency of list reviews, the named owner, and the process for removing access after a departure
Drill time and participation	Recurring	Facility count, number of staff who must take part, and whether drills run alongside existing disaster recovery tests	Drill schedule, scenarios covered, staff hours estimated per drill, and what the test report will contain
Evidence upkeep	Recurring	Volume of logs, drill records, access list versions and corrective actions; retention period under 164.316	Evidence index, storage location, retention rules, and who produces each artifact at audit time
External review or readiness assessment	Periodic, optional	Complexity of facility footprint, prior findings, and whether an independent reviewer is wanted before an audit	Named scope, reviewer qualifications, deliverable format, and a statement that the review does not issue an attestation or certificate
Auditor sampling and follow-up	Driven by the auditor's engagement	Number of facilities sampled, how many drill records and access lists the auditor requests, and the quality of prior evidence	Auditor's sampling approach and evidence list, confirmed in writing before fieldwork begins

Who owns contingency access and who can help

Your organization owns the contingency operations specification in practice. Under 45 CFR 164.310(a)(2)(i), the procedures must allow facility access to support restoring lost data under the disaster recovery plan and to run the emergency mode operation plan. Those two plans are required under 45 CFR 164.308(a)(7), so the people accountable for them must decide who may enter, under what conditions, and who grants that authority when normal processes are unavailable. Your team also decides whether the specification is reasonable and appropriate for your facilities, and documents the reasoning if it is not.

Decision rights: name the role that declares an emergency and authorizes out-of-hours entry to data centers, server rooms or records areas.
Access authority: define which staff, vendors or recovery responders may enter, and how their identity is confirmed when badge systems are down.
Addressable determination: record whether the specification is implemented or handled through an equivalent alternative measure.
Drills: schedule and run exercises that test entry during simulated outages, and keep the results.
Ownership of evidence: keep the signed plan, drill records and access logs in a location that survives the incident.

Check that the person named as decision owner can act at night and on weekends, and that the drill records show what changed after each exercise.

Where organizations usually fall short on emergency access

Contingency operations is addressable, so many organizations treat it as optional and never write it down. The gaps below tend to surface together: the facility plan does not reach the disaster recovery plan, the locks fail when the power does, and nobody has the authority to open doors during an emergency.

No written link to the DR plan

The standard ties facility access to the disaster recovery and emergency mode operation plans required under 164.308(a)(7). Many organizations keep facility procedures in a physical security binder and recovery steps in an IT document, so neither references the other. Check that the contingency plan names which rooms, cages or sites staff may enter to restore data, and which steps depend on that entry.

Access controls that fail with power

Electronic badge readers, magnetic locks and cloud-managed doors often stop working during an outage, which can leave responders locked out of the server room they need. Ask facilities and vendors what each access point does on loss of power or network, whether there is a battery or manual override, and who holds the keys. Test the fallback before an incident, not during one.

No named emergency authority

In an emergency, someone must decide who may enter a facility, outside the normal approval chain. Organizations often leave this to whoever is on call, which creates disputes about authority and gaps in the record. Name a primary and an alternate emergency authority for each site, with written authority to grant temporary access and a way to reach them after hours.

Emergency access drills never run

A written procedure that no one has rehearsed rarely works under pressure. Drills should walk a responder through getting into the facility under the emergency procedure, reaching the systems on the restore list, and logging the entry. Record what failed, such as an expired contact number or a key held off-site, and track the fix to closure.

Addressable decisions left undocumented

Because contingency operations is addressable, the entity must assess whether it is reasonable and appropriate, implement it if so, and otherwise document why not and adopt an equivalent measure. Teams that skip this step cannot show an assessor their reasoning. Record the assessment, the decision, the date and the approver, and review it when the facility or the recovery plan changes.

Questions buyers ask about contingency operations

Is contingency operations access required or addressable under HIPAA?

It is an addressable implementation specification, so it is not optional in the sense of being skipped without a record. Under 45 CFR 164.306(d)(3), you must first assess whether procedures for facility access during an emergency are reasonable and appropriate for your environment. If they are, you implement them. If they are not, you must document why and put in place an equivalent alternative measure, where that is reasonable and appropriate. Many organizations find the assessment easy to justify, because the disaster recovery and emergency mode operation plans they already must maintain under 45 CFR 164.308(a)(7) depend on someone being able to reach the systems physically. The decision and its reasoning should be written down and dated, because an assessor will ask to see it.

What does contingency operations access actually require me to build?

The specification asks for documented procedures that let authorized people enter a facility during an emergency to restore lost data under the disaster recovery plan and to run the emergency mode operation plan. In practice this means a written emergency access procedure that names who may enter, how they are identified when normal badge systems or staff are unavailable, how entry is logged, and how access is revoked afterward. It must be tied to the recovery plans themselves, so the people named can actually reach the data center, server room, or network closet the plans depend on. A procedure that exists only on paper, with no link to the recovery runbooks, is the most common gap an assessor finds.

How much does it cost to implement contingency operations procedures?

No supplied figure exists for this, so treat any number you see with caution. The cost is mostly labor and coordination rather than hardware. The main cost components are internal staff time to write and test the procedure, facilities or building management time to agree on emergency entry, and any change to physical access systems such as break-glass credentials or emergency key custody. Costs rise with the number of facilities, the number of people who need emergency entry, and how many third-party data centers or colocation providers you rely on, since each may need its own agreement. Costs are mostly one-time for drafting and first testing, with recurring cost for periodic testing and for keeping the access list current. Ask any consultant for a quote that separates drafting, testing, and ongoing review, and states which of those they will perform.

How long does it take to put contingency access procedures in place?

No supplied duration exists, so plan around your own environment. The timeline depends on how many facilities host ePHI systems, whether your disaster recovery and emergency mode operation plans are already current, and how many departments must sign off, including facilities, security, and clinical or operations leaders. An organization with a single data center and up-to-date recovery runbooks has a much shorter path than one with several leased sites and plans written years ago. The work usually runs in three steps: confirm the recovery plans, draft and approve the access procedure, and then test it with a tabletop exercise or a supervised drill. Ask any provider to break its schedule into those steps so you can see where your own teams are on the critical path.

What do we need from our internal team to meet this specification?

Your internal team owns the control, so it must supply the decisions and the knowledge that an outside party cannot. You will need a security or compliance owner who accepts the addressable determination, facilities staff who know how doors, locks, and badge systems behave during outages, and the recovery plan owners who can confirm which people must be able to reach which systems. System administrators should confirm that emergency personnel can actually perform restoration tasks once inside. Expect to commit time for the drafting review, at least one test, and a post-test debrief. Naming these people in the procedure also matters, because an assessor will ask who approves emergency entry and who reviews the log afterward.

Can we do contingency operations work in-house, or do we need outside help?

Yes, many organizations draft and test this procedure in-house, provided they have the right people and time. Outside help is most useful when the team lacks experience writing facility security procedures, when several sites or third-party data centers are involved, or when an independent reviewer is needed to challenge the addressable determination. An implementation partner such as DeployOpen can prepare the recovery runbooks, the access procedure, the test scenario, and the evidence package for a fixed scope agreed in writing before work starts. The organization still owns the control and its decisions. Only an independent auditor or assessor can issue findings or any report on the result. When comparing options, ask a provider exactly which artifacts it will deliver and which it expects your team to produce.

What evidence will an auditor ask for on contingency operations?

An assessor will typically ask to see the documented procedure, the record of your addressable decision under 45 CFR 164.306(d)(3), and proof that the procedure connects to your disaster recovery and emergency mode operation plans under 45 CFR 164.308(a)(7). They will also look for evidence that the procedure was tested, such as a drill record with the date, participants, scenario, and findings, plus any corrective actions. Access logs or sign-out records from a real or tested emergency entry are useful, as is the current list of people authorized for emergency entry and when it was last reviewed. Missing dates, unnamed approvers, and a procedure that contradicts the recovery runbook are the findings organizations most often need to fix before an assessment.

Does passing a HIPAA assessment mean we have an official certification?

No. There is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance, that HHS does not endorse or recognize private certifications, and that such certifications do not stop HHS from later finding a violation. For this specification, a third-party review can show that your procedure exists, is documented, and was tested, but it cannot grant an official HIPAA seal. Ask any assessor to describe precisely what its report covers and what it does not, and keep the output as internal evidence for OCR inquiries rather than a compliance badge.

How DeployOpen prepares contingency access evidence

DeployOpen's part in a contingency operations project starts with a written scope that names the facilities, systems, emergency scenarios and roles covered. Before any work begins, the scope should state which parts of the emergency access procedure DeployOpen will help build, such as the break-glass access route to the data center or colocation cage, the designated emergency contacts who can authorize entry, and the records kept when access is granted during an emergency. The covered entity owns the decision on whether the specification is reasonable and appropriate and, if it is not, the documented alternative. DeployOpen can help draft the options, but the entity makes and signs that determination.

In the client's own environment, implementation usually centers on the mechanics that let authorized staff reach ePHI systems when normal access fails. That can include documented fallback procedures tied to the disaster recovery plan and emergency mode operation plan, configuration of emergency accounts or badge overrides in the existing access control system where the platform and facility allow it, offline copies of runbooks and contact lists, and test records from drills. DeployOpen does not control the client's physical building or its landlord's systems, so the scope should list which access changes the facility owner must approve and who signs off on them. Confirm the exact capabilities of your access control and identity products with their vendors before writing them into the scope.

DeployOpen then prepares the evidence an independent assessor will ask to see: the written procedure, the approval chain for emergency entry, drill results, access logs from exercises, and a mapping from each artifact to the requirement it supports. Assessors test the procedure as it operates, so the evidence should show a real exercise rather than a document alone. DeployOpen does not issue audit reports, attestations or certifications. Only the independent auditor or assessor the organization selects can test the controls and report on them, and HHS does not recognize private certifications for the Security Rule. Ask any partner to state this boundary in the statement of work.

164.310(a)(2)(i) Contingency operations