Many facilities have a backup system running quietly in the background, and a green status light somewhere. That is reassuring until the day a server fails or ransomware strikes and someone discovers that the backup was incomplete, corrupt or stored on the same network as the infected machines. The only reliable way to know whether your backups work is to restore from them on purpose.
Testing takes time, and nothing seems broken. Staff assume that if the software reports success, the data is safe. But a "successful" job only means the software finished, not that the right files were included or that they can be opened. Common surprises include:
A new server or folder was never added to the backup
The backup covers files but not the settings and applications needed to run them
Backup credentials expired quietly
Backup storage filled up
Backups are on the same network and were encrypted along with everything else
Before testing, list your critical systems and decide how quickly each must return.
Electronic health record or its connection to the hosted vendor
Pharmacy and medication systems
Billing and payroll
Shared drives with policies, schedules and resident documents
Phone and nurse call systems
Building access and camera systems
Two ideas help set expectations:
Recovery time objective: how long you can be without this system.
Recovery point objective: how much recent data you can afford to lose, such as the last hour or the last day.
Most administrators can answer these with a few honest questions. How long could we run on paper? How much charting could we recreate?
A well-known rule of thumb is three copies of data, on two different kinds of storage, with one copy kept offsite or offline. Today many organizations add that at least one copy should be unchangeable or disconnected so that ransomware cannot reach it. Cloud-hosted systems also need review: ask your vendor how they back up your data and how quickly they can restore.
Plan the test for a quiet time, tell the right people, and write down results.
Choose the systems to test. Rotate through them over the year.
Confirm who is responsible and who must approve.
Set up a separate environment for restoring, so you do not overwrite live data.
Restore a few individual files from different dates and open them. Confirm they are readable and correct.
Restore a full folder or database and check that recent records are present.
Restore a full server or virtual machine into the test environment, if applicable, and confirm it boots and the application starts.
Time the restore. Compare it to your recovery time objective.
Check the date of the newest data you recovered against your recovery point objective.
Record what was tested, who did it, how long it took and what failed.
Fix gaps and test again.
Report results to leadership in plain terms, such as "We can restore the billing server in about four hours, but the nurse call logs were not being backed up."
Schedule the next test.
Which systems are and are not included in the backup?
Where are copies stored, and can ransomware reach them?
Who can delete backups, and is multi-factor authentication required?
How often are restores tested, and may we see the results?
Are backups encrypted in storage and in transit?
What happens to our backups if we end our contract?
The HIPAA Security Rule requires covered entities to maintain a data backup plan, a disaster recovery plan and an emergency mode operation plan. CMS emergency preparedness requirements for long-term care facilities also expect plans for continuing operations and protecting records. Test results are useful evidence that these plans are real rather than paper.
A restore is only as good as the people who run it. Make sure at least two people know where the instructions are and how to reach the vendor after hours. Keep a printed copy of the steps, since your documentation may sit on a server that is down.
UnityCare IT can review your backup coverage, run restore tests and document results for healthcare organizations in Oklahoma, Texas and Arkansas. If you cannot remember your last restore test, today is a good day to schedule one.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172