When ransomware or a failed server takes down a facility, the first question is always the same: can we restore? A good backup plan is the difference between a rough day and a crisis lasting weeks. Many facilities believe they have backups, but have never checked what is covered, where the copies live or whether a restore would actually work.
This guide walks through a practical plan you can put in place without a large budget.
Before choosing tools, list the data and systems that matter. For a skilled nursing facility that usually includes:
File servers with scanned records, policies and administrative documents
Local databases and applications, such as billing, payroll or dietary software
Email and shared calendars, if hosted locally or in a cloud tenant
Virtual machines and domain controllers
Configuration files for firewalls, switches and wireless controllers
Any locally stored data from your EHR, if applicable
If your EHR is cloud-hosted, such as PointClickCare, ask the vendor in writing how they back up your data and what recovery options exist. Do not assume.
A widely used guideline for backups is 3-2-1:
Keep three copies of your data: the original and two backups.
Store them on two different types of media or platforms.
Keep one copy offsite or otherwise isolated from your network.
The isolated copy is the one that matters most against ransomware. Attackers often look for backup systems and encrypt or delete them first. An offsite cloud copy, an offline disk that is disconnected after each run, or an immutable backup that cannot be altered for a set period all protect you.
Two questions drive every backup decision:
This is the recovery point objective. If you back up nightly, you could lose a day of work. For some systems that is fine. For others, it is not.
This is the recovery time objective. Restoring a few files takes minutes. Restoring an entire server from the cloud over a modest internet connection can take much longer than most people expect.
Write these targets down for each major system and share them with leadership. They are business decisions as much as technical ones.
Backups hold the same sensitive data as your live systems, so treat them the same way.
Encrypt backup data in transit and at rest.
Use separate credentials for backup systems, with multifactor authentication where available.
Restrict who can delete or change backup jobs.
Keep backup servers off the regular user network when possible.
A backup you have never restored is a guess. Put testing on the calendar:
Monthly: restore a few random files and confirm they open.
Quarterly: restore a full application or virtual machine to a test environment.
Annually: walk through a full disaster scenario with the people who would be involved.
Record the date, what was restored, how long it took and any problems. This documentation also supports your HIPAA contingency planning, which expects a data backup plan and a disaster recovery plan.
Backup jobs that fail silently for weeks
Laptops and devices that hold local files not covered by any job
New servers that were never added to the backup schedule
Retention periods that are too short to recover from a problem noticed late
No one assigned to review backup reports
Assign a named person to review backup alerts daily or weekly, and make sure someone covers when that person is out.
A workable first plan might be: nightly backups of all servers to a local device, a copy replicated to an encrypted cloud location, monthly spot restores, and a documented recovery order that lists which systems come back first. Clinical and communication systems typically come ahead of administrative ones.
UnityCare IT designs and monitors backup and recovery plans for long-term care and clinic environments, including restore testing and documentation. If you are not sure what your current backups cover, we can review them with you and point out the gaps.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: 2524 N Broadway Ste 554 PMB 947974, Edmond, Oklahoma 73034