Control cross-reference
HIPAA Security Rule and your incident response exercise.
The HIPAA Security Rule requires response and reporting procedures, and testing of contingency plans. The specifications below are the ones an exercise speaks to.
This is a cross-reference, not an assessment. Running an exercise does not by itself satisfy any control here. It produces a dated, attributed record, and your auditor decides what that record is worth against these criteria.
The controls
What an exercise speaks to.
-
164.308(a)(6)(ii)
Response and reporting procedures
-
164.308(a)(7)(ii)(D)
Testing and revision of contingency plans
The evidence
What a reviewer is actually asking for.
Not the plan. Almost everyone has a plan. They are asking whether it was exercised, when, by whom, and what that surfaced. That is a record with a date and people in it, and it only exists if the exercise actually happened.
Run one.
A live tabletop on your own systems and plan, with the record written by the time you finish, for $199.