Your email outage should be included in your HIPAA contingency plan. System failure is one of several causes of data loss mentioned in this standard, along with fire, vandalism, and natural disasters. Under 45 CFR 164.308(a)(7), you are required to have three of the five implementation specifications under the contingency plan standard, namely your data backup plan, disaster recovery plan, and emergency mode operation plan.

Email is highly utilized in healthcare. Paubox’s 2026 healthcare email security report, which analyzed 170 email-related breaches in 2025, notes Microsoft 365 is used by approximately 79% of healthcare organizations. If your entire organization uses one email platform, an outage will affect all of your departments that use email.

 

Add email to your applications and data criticality analysis

Email should be part of the picture when you're figuring out which systems matter most to your organization. Your criticality analysis is an addressable specification under 164.308(a)(7)(ii)(E). You will want to include email when performing your criticality analysis to determine which applications and systems your organization relies on most. Many organizations rank the electronic health record (EHR) carefully but overlook email.

When researchers reviewed adverse event reports at a hospital in China, they identified 204 reported EHR downtime events from January 2018 to August 2022. Of those events, 96.1% were unplanned, and 76% were reported as patient care disruptions. The study states these events “can disrupt hospital operations and threaten patient safety.”

Look at what processes would be impacted if your email was down. For example, your orthopedic practice may rely on email to send pre-op instructions, prior auth letters and images to outside facilities. You will want to prioritize these messages based on their impact on patient care and decide which ones to keep sending during an outage.

 

Keep retrievable copies of protected messages

Your data backup plan is a required implementation specification. According to this requirement, you are expected to produce exact, retrievable copies of your electronic protected health information (ePHI). When it comes to your email, you will want to back up any messages you send and receive, including attachments. Perhaps you email a referral to another provider, and that becomes your only record that you referred them.

A study in JAMA Health Forum examined 374 ransomware attacks on US healthcare delivery organizations between 2016 and 2021. Over the study period, attacks became less likely to be resolved by restoring from backups. The authors concluded ransomware attacks “disrupt care delivery and jeopardize information integrity.” The study relied on publicly reported attacks and did not isolate email systems.

Paubox Email Suite Premium includes email archiving, which automatically retains your inbound and outbound email and supports full-text search by sender, recipient, subject, body, and attachment. A separate archive can help staff find a specific message during an outage, provided your plan defines who has access and how often retrieval is tested.

Read also: Paubox features healthcare providers need for HIPAA compliance

 

Define emergency mode operation for email

A required implementation specification of your contingency plan is the emergency mode operation plan. Make sure you have processes established that keep PHI protected while operating in emergency mode. Even if your email system goes down, you will still need a way to share certain information with your patients.

A cyberattack on the University of Vermont Medical Center forced their lab to operate on manual processes for more than 25 days. They kept lab reporting and billing going, but it took “many hours and resources” to reconcile the work for billing afterward.

Workarounds appear even when systems are running. In Paubox’s Healthcare email security maturity index 2026, a survey of 170 US healthcare IT leaders, 34% reported clinical staff bypassing encryption to avoid the portal process. An outage removes the approved channel entirely, so your plan should name approved fallback channels, the information each may carry, and who can authorize exceptions.

 

Confirm what your email vendors owe you

If your email provider stores your PHI, they are considered a business associate. YBecause the contingency plan standard applies to business associates directly, each one must maintain a contingency plan of its own.

Your email provider may not be the only business associate that stores your PHI. If you use a third party for your email encryption service and another one to store your archives, you will want to make sure they both have contingency plans in place.

When your email provider is down, you will want to know who you can contact and what they can do to help get you back up and running. You should know this information if you have multiple business associates that store your PHI. Paubox allows you to use your Google or Microsoft 365 email address with their service and provides a business associate agreement. You can also check their system status if you ever have questions about an outage.

 

Decide whether the outage is a security incident

Should your email provider experience an outage, a security incident could be the cause. Anytime there is a security incident you will need to follow the procedures outlined in 164.308(a)(6). It is possible to have a security incident without a breach, but you will still need to assess whether any of your information was compromised.

According to our maturity index 2026, 58% of organizations experienced a breach of their email in the past 24 months. When your email is compromised, you will need to determine if there was a breach and take the appropriate actions to protect your PHI.

If one of your referral partners had an email outage you may experience similar issues when trying to refer patients to them. You will want to determine what you can do if this happens.

 

Test the plan with a realistic email scenario

Testing your contingency plan matters, and you should have a process in place to revise it if the need arises. Confidence in a plan does not show it works. In Paubox’s maturity index, every respondent rated their breach detection as excellent or good, yet most of the same respondents had been breached.

A group of researchers in a Swiss study of five hospital pharmacies tested whether their hospital pharmacy's continuity plans were up to par by doing a simulation of a blackout. The share of expected items in the plans rose from 47.9% to 54.2%, and pharmacies with stronger plans performed better in a later full-scale exercise simulating a cyberattack. The researchers pointed to “the usefulness of disaster simulations,” though the sample was small and the study covered pharmacy operations rather than email.

If your email went down on a Monday morning, you would want to know which processes you can complete without it. You may have test results that you need to send to your patients and information you need to send to your insurance companies.

 

What a contingency plan cannot do

Having a contingency plan will not ensure that your email provider comes back online or that your patients will receive their information on time. The Security Rule does not specify a time that your organization must have your systems and data recovered.

However, a 2025 proposed update to the Security Rule would require procedures to restore critical systems and data within 72 hours, and it would require business associates to notify covered entities within 24 hours of activating their contingency plans. The 2026 Unified Agenda lists the update as a long-term action with final action projected for July 2027, so neither requirement is in force yet.

A scoping review of 26 articles on electronic medical record downtime concluded downtime planning activities “mitigate the effects of disasters on patient safety outcomes and clinical delays.” The review did not examine email or measure how much harm planning prevented.

Learn more: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Does an email pause the deadline for patient records requests?

No, the deadline for acting on a patient's request for access keeps running during an outage, although the rule's single extension remains available if the patient receives a written explanation within the original deadline.

 

How long should we keep our contingency plan and outage records?

Covered entities and business associates must keep the written contingency plan, along with required records such as documented security incidents and their outcomes, for six years from creation or from the date last in effect, whichever is later.

 

Does a small practice need the same email contingency plan as a hospital?

A small practice may scale its approach to its size, complexity, technical capabilities, and costs, but it must still maintain a data backup plan, a disaster recovery plan, and an emergency mode operation plan.