Backups you've tested, and a plan for the day systems go down

Backups are a HIPAA requirement, not an option

The Security Rule's contingency plan standard at 45 CFR 164.308(a)(7) requires every practice to have a data backup plan, a disaster recovery plan and an emergency mode operation plan. In plain terms: keep retrievable copies of patient data, be able to restore it and know how you will keep caring for patients while systems are down. Testing those plans and ranking which systems matter most are also part of the standard.

Plenty of practices have a backup. Far fewer have one that would survive ransomware, restore in a reasonable time and has actually been tested.

Why old backups fail

• They're reachable by the attacker. Ransomware looks for backup files and network drives and encrypts or deletes them first. A USB drive plugged into the server is not a safe copy.
• Nobody tests restores. The backup software reports success for years, and then the files turn out to be incomplete or corrupt on the day you need them.
• Imaging is left out. X-ray and imaging databases are often stored separately from the practice management data and quietly skipped.
• Cloud is assumed to be covered. A cloud-hosted EHR is backed up by the vendor, but email, scanned documents, spreadsheets and local imaging usually aren't. Microsoft 365 retention is not the same as a backup.
• Restore time is unknown. Copying several terabytes of imaging data back from the internet can take days. You need to know that before an outage, not during it.

What we put in place

1. Layered backups: a fast local copy for everyday restores and an encrypted offsite copy in a secure cloud, so one event can't take out both.
2. Immutable storage: offsite copies that can't be changed or deleted for a set period, even with administrator credentials. This is the main defense against ransomware wiping your backups.
3. Full coverage: servers, practice management and imaging databases, workstations where data lives locally, and Microsoft 365 mail, OneDrive and SharePoint.
4. Monitoring: every job is checked daily, and failures are fixed, not just logged.
5. Restore testing: we restore files and full systems on a schedule and record the results, which gives you evidence for the testing part of the contingency plan standard.
6. Encryption: backups are encrypted in transit and at rest, and access to them is limited and logged.

Downtime planning

Technology can fail even with good backups. Internet outages, power loss, a vendor's cloud going down or a ransomware attack can all leave you without your EHR for hours or days. A downtime plan answers practical questions ahead of time:

• How will the front desk see today's schedule and patient contact details?
• How will providers document visits, and how will notes get into the chart afterwards?
• Who calls whom, and in what order: the EHR vendor, your IT team, your insurance carrier, your attorney?
• Which systems come back first, and how long can each one realistically be down?
• How will you reach patients if the phones are out?

We write the plan with your practice manager, keep printable downtime forms ready, set up automatic exports of the next day's schedule where your system supports it, and walk through a short tabletop exercise with your team at least once a year.

Recovery when it counts

If you lose a server, a location or your data, we lead the technical recovery: replacement hardware or cloud systems, restores in the order your plan sets, and checks that clinical systems work before staff go back to them. Multi-location practices can often keep one office running while another recovers.

Fits with the rest of your compliance

Backup reports, restore test records and the downtime plan all feed your HIPAA risk analysis and documentation. We sign a business associate agreement, because our backup systems hold copies of your patient data.

Questions about backup & downtime planning