La. Admin. Code tit. 50 § XXI-1145

Current through Register Vol. 50, No. 11, November 20, 2024

Section XXI-1145 - Emergency Preparedness

A. The F/EA, regardless of the architecture of its systems, shall develop and be continually ready to invoke an all hazards plan to protect the availability, integrity, and security of data during unexpected failures or disasters (either natural or man-made) to continue essential application or system functions during or immediately following failures or disasters.

B. The all hazards plan shall include a disaster recovery plan (DRP) and a business continuity plan (BCP). A DRP is designed to recover systems, networks, workstations, applications, etc., in the event of a disaster. A BCP shall focus on restoring the operational function of the organization in the event of a disaster and includes items related to information technology (IT), as well as operational items such as employee notification processes and the procurement of office supplies needed to do business in the emergency mode operation environment. The practice of including both the DRP and the BCP in the all hazards planning process is a best practice. At a minimum, the all hazards plan shall address the following scenarios:

1. the central computer installation and resident software are destroyed or damaged;

2. the system interruption or failure resulting from network, operating hardware, software, or operations errors that compromise the integrity of transaction that are active in a live system at the time of the outage; and

3. system interruption or failure resulting from network, operating hardware, software or operations errors that compromise the integrity of data maintained in a live or archival system.

C. The all hazards plan shall specify projected recovery times and data loss for mission-critical systems in the event of a declared disaster. The following minimum criteria are required:

1. system restoration within 24 hours;

2. two physical locations for maintaining data; and

3. backups of all system data every 24 hours.

D. The F/EA shall annually test its plan through simulated disasters and lower level failures in order to demonstrate to LDH that it can restore system functions. In the event the F/EA fails to demonstrate through these tests that it can restore system functions, the F/EA shall be required to submit a corrective action plan to LDH describing how the failure shall be resolved within 10 business days of the conclusion of the test.

La. Admin. Code tit. 50, § XXI-1145

Promulgated by the Department of Health, Bureau of Health Services Financing, the Office of Aging and Adult Services, and the Office for Citizens with Developmental Disabilities, LR 491564 (9/1/2023).

AUTHORITY NOTE: Promulgated in accordance with R.S. 36:254 and Title XIX of the Social Security Act.