Backups and recovery

A backup you have never restored is a hypothesis, not a backup. Here is what is actually kept for you, how quickly it comes back, and how to check any of that is true rather than taking it on faith.

Two numbers that define a backup

Decide both before you need them. They are business decisions, not technical ones: how many hours of records can this practice re-enter, and how many hours can it operate on paper?

What is backed up, and by whom

Practices consistently over-estimate their coverage because different systems are backed up by different parties. Write down who owns each line:

• Website. For static sites we host, every publish is an immutable versioned snapshot — rollback is near-instant and the history is retained. For WordPress, files and database on a schedule.
• Email. Often the biggest gap. Mail sitting on a server is not a backup — a deleted mailbox or a compromised account takes it with it. Check whether yours is separately archived.
• Your EHR. Usually the vendor’s responsibility if cloud-hosted — but get their RPO and RTO in writing, and ask how you would get your data out if you left. If self-hosted, it is entirely yours.
• Workstations. Anything saved to a desktop rather than a server is typically backed up by nobody at all.
• Imaging and scanned documents. Frequently on a separate box everyone forgot about.

The rule worth following

3-2-1: three copies of the data, on two different kinds of media, with one held off-site. The off-site copy is what survives fire, theft and flood. Add one modern refinement: at least one copy must be offline or immutable — something ransomware cannot reach and delete, because encrypting the backups first is now standard practice for attackers. See Ransomware readiness.

Test the restore

1. Pick something real

   A specific file from a specific date, or a full system. Not a token test file.

2. Restore it somewhere safe

   Never over the live copy. A test location, or a spare machine.

3. Open it and check the contents

   Backups can complete “successfully” and contain corrupt or empty data. Verify the file actually opens and holds what it should.

4. Time it honestly

   Note how long the whole thing took. That is your real RTO, and it is usually longer than the number in the plan.

5. Write down what happened

   Date, what was restored, how long, who did it. HIPAA contingency planning expects testing; this document is your evidence.

Twice a year is a reasonable cadence for most practices. Once, ever, is not.

Retention and HIPAA

HIPAA requires a data backup plan, a disaster recovery plan and an emergency mode operation plan as part of contingency planning — and requires that you test and revise them. Separately, state law governs how long medical records must be kept, and those periods are typically measured in years and run longer for minors. Your backup retention and your record retention are different questions; make sure someone has answered both.

FAQ