Backup conversations fail when they stay abstract. “We have Carbonite” or “it’s in the cloud” is not an answer. The only answer that matters is: what did we restore, how long did it take, and who did it while the office was closed.
What must be backed up
- Practice-management or document-management databases.
- Imaging or scanned records if you are clinical.
- Microsoft 365 mail and files if that is where work lives — cloud vendors are not your backup by default.
- Line-of-business servers, including the forgotten one under the front desk.
- The configuration of phones and the firewall, or you will rebuild those by memory.
How restores are proven
Ask for the date of the last restore test, what was restored, and a screenshot or ticket — not a brochure. Restore a sample of files and a database to a safe location. If the vendor will not do that annually, they are selling storage, not recovery.
Write the clock: how long until the front desk can schedule again, and how long until clinicians have images or documents. If nobody knows, that is your finding.
Ransomware realities
Backups connected all day to the same network can be encrypted too. You want a copy that is offline, immutable, or otherwise not reachable by the same credentials the office uses at noon. This is not paranoia; it is how modern incidents actually unfold.
Insurance questionnaires will ask these same questions. Answering “not sure” is an answer. It is not a good one.
Cloud vs local
Local-only backup dies in a fire or theft. Cloud-only backup dies when the internet is down and you cannot get a large restore in time. Most practices need both a local copy for speed and an off-site copy for disasters. “The vendor hosts our software” still needs an export you control.
A one-page recovery card
- Who declares an incident and who calls the internet, IT, and software vendors.
- Where the restore instructions live (not only inside the system that is down).
- How to take payments or messages if phones and software are offline for a morning.
- Who tells staff not to pay a ransom without advice.
Keep that card on paper and in a mailbox that still works if the office tenant is down. Then score the rest of continuity. This article is not a certification that you can recover.