Many facilities can say they have backups. Far fewer can say when they last restored from one. That gap matters. A backup that has never been tested is an assumption, and assumptions are expensive when a server fails, ransomware encrypts a file share, or someone deletes a folder of care plans by mistake.
This checklist gives administrators and IT contacts a simple quarterly routine. It does not require deep technical skill, but it does require someone to own it and write down the results.
Before you test anything, list what matters most. For a typical skilled nursing or assisted living operator, that includes:
Your electronic health record, whether hosted by a vendor or run locally
Shared network drives with policies, schedules, HR and business office files
Email and calendar data
Phone system settings and call recordings, if you keep them
Accounting, billing and payroll systems
Configuration files for firewalls, switches and Wi-Fi
For each item, note where the data lives, who backs it up, and how often. If a cloud vendor hosts a system, find out what that vendor backs up and what they expect you to handle. Do not assume.
Check the backup reports for the last 90 days. Look for failed jobs, skipped systems, and warnings that have been ignored. A report that always says completed with warnings deserves a closer look.
Pick a random file from last month and restore it to a different location. Open it. This proves the basics work and measures how long a simple restore takes.
Once a quarter, restore something larger, such as a department folder or a single staff mailbox. Confirm permissions come back correctly and that the files open.
Once or twice a year, restore an entire server or system into a test environment. You do not need to test every system every quarter. Rotate through them so each critical system gets tested at least annually.
Ransomware often targets backups. Confirm at least one copy is stored offsite and cannot be changed or deleted from your normal network credentials. This is sometimes called an immutable or offline copy. Ask whoever manages your backups to show you where it is and prove it is separate.
Keep a one-page log with these columns:
Date of test
System tested
Who performed it
Time to restore
Problems found
Fixes assigned and due dates
This log also supports your HIPAA contingency planning documentation. The Security Rule expects covered entities to have a data backup plan, a disaster recovery plan, and procedures to test and revise them. A dated test log is practical evidence you are doing that.
Testing is more useful when you compare it against targets. Two questions to ask leadership:
How long can we be down? If the EHR were unavailable, how many hours before resident care is affected, and how long can staff run on downtime procedures?
How much data can we afford to lose? If you restore from last night's backup, what work would need to be re-entered?
These answers are sometimes called recovery time and recovery point objectives. They do not need to be precise. They simply tell you whether your current backup schedule and restore speed are good enough.
Quarterly tests tend to find the same issues:
A new server or shared drive was never added to the backup
Backup storage is nearly full and older copies are being dropped
The person who knows the restore process left the organization
Encryption keys or passwords for the backup were not documented
Restores work, but take far longer than leadership expects
Finding these during a calm Tuesday is much better than finding them during an outage.
Backups restore data, but staff still need to keep caring for residents while systems are down. Pair your restore test with a short review of paper downtime forms, printed census and medication lists, and who to call.
UnityCare IT helps healthcare operators design backup strategies, run scheduled restore tests, and document the results. If you are not sure when your last successful restore was, we can walk through your current setup and help you build a simple quarterly routine.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: 2524 N Broadway Ste 554 PMB 947974, Edmond, Oklahoma 73034