Backup & Recovery — Does HIPAA require us to back up our data?

Yes. The HIPAA Security Rule explicitly requires a data backup plan as part of your contingency planning. Backups must be encrypted, tested regularly, and stored in a way that allows timely recovery in the event of a disaster or system failure.