HIPAA Training and Certification

Objective

This business impact assessment template document is purposely created to identify the key business processes and technology components that would suffer the greatest financial, operational, customer, and/or legal and regulatory loss in the event of a disaster. The main intent of a BIA is to identify all the critical resources, systems, facilities, records, etc., that are required for the continuity of the business. Additionally, the time it would take to recovery such resources will be identified. The following documents are offered to help the business complete the assessment:

The BIA is used to quantify adverse impacts to the business caused by a loss of business operations (functions/processes). Based on the level of impact, the appropriate recovery strategy is selected to mitigate these impacts.

Table of Contents of Conducting a Business Impact Analysis

INTRODUCTION

BUSINESS IMPACT ANALYSIS

PHASE ONE – PROJECT DEVELOPMENT

PHASE TWO – GATHER DATA

PHASE THREE – APPLICATION & DATA CRITICALITY

PHASE FOUR – ANALYZE THE DATA

FINAL REPORT & PRESENTATION

NEXT STEPS

APPENDIX

Objectives

Due to many regulatory compliance regulations, the organization must implement Business Impact Analysis, Business Continuity, and Disaster Recovery Planning Practices to make sure the protection of data. In order to carry out this undertaking, there are numerous steps that organization will be implemented to detect critical business functions, processes, and applications that process to safeguard data and to understand the potential impact to the business if a disruptive event occurred.

The first step of implementing the Business Continuity and Disaster Recovery Program for the organization is to conduct a Business Impact Analysis. This questionnaire will assist each business unit to detect their critical business functions and recovery requirements in addition to estimating the impact of a disaster (or prolonged outage) to the business unit. Once the survey is completed, the Business Impact Analysis Project team will review the data, analyze and create a prioritized recovery strategy to present to senior management.

For the purpose of this Business Impact Analysis, answer each question based on the “worst-case scenario”. This means your workplace and all records; files and equipment in it are inaccessible. The priority of this questionnaire is to make out any business process or application that at present contains vital data. However, please answer all questions regardless of data status. By completing all questions to the best of your knowledge, a recovery strategy that best meets the need of the business can be established.

A few questions will be directly associated with a specific process whereas other questions are of the business unit in general. Some sections contain an additional “Notes” area to amplify or explain your responses. While this is not an obligation, it can be helpful in serving the Project Team understand the nature of your business unit operations.

Table of Contents: Business Impact Analysis Survey Template

OBJECTIVE

GENERAL INFORMATION

PROCESS INFORMATION

DEPENDENCIES

REQUIRED RESOURCES

POTENTIAL IMPACT

Executive Overview

Objectives

The purpose of the Business Impact Analysis (BIA) Template was to facilitate organization to make out which business units, operations, and processes are essential to the endurance of the business. The Business Impact Analysis has identified the time frames in which indispensable business operations have to be reinstated to full functionality following a disruptive event. It has identified the business impact of not performing critical business operations based on a worst-case scenario. The BIA has also identified the resources necessary to resume business operations to a functioning level.

A worst-case scenario presumes that the physical infrastructure supporting each individual business unit has been destroyed and all records, equipment, etc are not approachable within 30 days.

The overall objectives for this Business Impact Analysis were to:

The RTO is the extremely acceptable time a process can be not working following an outage / disruptive event.

These timeframes may have to be re-evaluated to meet the necessities of the Technology capabilities. If the capabilities of technology do not meet the requirements of the business unit, a gap exists. These gaps must be lessened to prevent extended outages and impact to your organization.

Table of Contents: Executive BIA Finding Report

EXECUTIVE OVERVIEW

BUSINESS UNIT RESULTS

SUMMARY OF FINDINGS

CONCLUSION

APPENDIX

The interview was conducted by on .

Overview of Business Unit (Department)

The Department is responsible for

Business Processes

Vital Data Information

Vendors

Internal Dependencies

External Dependencies

Applications

Purpose:

The Business Impact Analysis Policy document establishes the activities that need to be implemented by each Business Department, Technology Department, and Corporate Department within the organization.

All departments within the organization must utilize this methodology to identify the processes they perform, the required resources to perform those processes, the timeframes in which those processes need to be recovered, any supporting dependencies, resources, facilities, etc, and the potential financial, operational, and legal/regulatory impact for the processes.

Table of Contents

TERMINOLOGY
ACCOUNTABILITY
COMPLIANCE
REVISION HISTORY
ENDORSEMENT

I. POLICY OVERVIEW

II. BIA REQUIREMENTS

III. BIA RESULTS

APPENDIX

APPENDIX A: BUSINESS IMPACT ANALYSIS STANDARDS

Objective

The intention of the Application and Data Criticality Analysis is to find out the criticality to business associates of all application based components and the probable losses which may perhaps be incurred if these components were not available for a period of time. This questionnaire is designed to collect the information essential to hold up the development of alternative processing strategies, solutions and IS Recovery plans.

The Business Impact Assessment (BIA) should be completed prior to this engagement. The results of the Business Impact Assessment should be used to assess technology requirements based on the business needs.

The questionnaire also serves as a compliance method for meeting the Regulatory Compliance Security Rule requirements for Application and Data Criticality Analysis.

Table of Contents of Applications and Data Criticality Analysis Template

OBJECTIVE

RESPONDENT INFORMATION

APPLICATION INFORMATION

DATABASE INFORMATION

HARDWARE (SYSTEM) INFORMATION

NETWORK INFORMATION