Every healthcare organization says it has backups. Fewer can answer a more useful question: if the main server and the building's network were gone this afternoon, how long would it take to get resident records back, and how much recent data would be lost?
The classic 3-2-1 rule is a simple framework for building backups that survive real disasters, including ransomware that specifically targets backup systems.
3 copies of your data: the live copy plus two backups
2 different types of storage: for example, local disk and cloud storage
1 copy off-site: physically or logically separated from your main environment
Many security teams now extend this to 3-2-1-1-0: one copy that is offline or immutable, and zero errors when backups are test-restored.
List what you would need to operate:
EHR data, whether hosted by the vendor or stored locally
File shares with policies, schedules, forms and scanned documents
Email and calendars
Business office and payroll data
Phone system configuration
Server and network device configurations
If your EHR is cloud hosted, such as PointClickCare, ask your vendor what they back up, how often and what your contractual recovery options are. Do not assume that cloud means backed up in the way you need.
Two numbers drive every backup decision:
Recovery point objective (RPO): how much data can you afford to lose? Four hours? One day?
Recovery time objective (RTO): how long can you be down before care or operations are seriously affected?
Administrators and DONs should help set these, because they depend on clinical reality, not just technology.
Modern ransomware often looks for backup servers and deletes or encrypts them first. Protect them by:
Keeping at least one copy offline, or in immutable storage that cannot be altered for a set period
Using separate credentials for backup systems, not the same admin accounts used day to day
Requiring multi-factor authentication on backup consoles and cloud storage
Alerting on backup failures and on unusual deletions
Microsoft 365, Google Workspace and similar services run on shared responsibility. The provider keeps the service running, but you remain responsible for your data. Deleted mailboxes, overwritten files and compromised accounts may not be recoverable without a separate backup. Review the retention settings and consider a third-party backup for critical tenants.
A backup you have never restored is a hope, not a plan. Schedule:
Monthly: spot-check restoring a few files
Quarterly: restore a full server or critical application into a test environment
Annually: a full disaster recovery exercise that includes the people and the paperwork, not just the technology
Document the results, the time it took and anything that went wrong.
Backing up to a drive that sits next to the server, where the same fire, flood or malware can reach it
Mapping backup storage as a drive letter that ransomware can encrypt
Never checking backup alerts
Excluding laptops and workstations where staff store files locally
Having no written restore procedure, so recovery depends on one person's memory
The Security Rule's contingency plan standard expects a data backup plan, a disaster recovery plan and an emergency mode operation plan, with testing and revision procedures as addressable items. Good backup practice supports all of them, and CMS emergency preparedness requirements for long-term care facilities also expect continuity of operations.
During an outage, people will ask which system comes back first. Decide in advance and put the order in writing, with the person responsible for each step. Typically network and identity services come first, then the EHR connection, then communications and file shares. Having this list prevents arguments during a stressful day and shortens the time to a working facility.
Pick one critical system this week and ask: when was it last restored successfully, and how long did it take? If nobody knows, that is your starting point. UnityCare IT can review your backup design against 3-2-1 and help you test recovery before you need it.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172