Ask a nursing home administrator whether their data is backed up and the answer is usually yes. Ask when they last restored a file from that backup, and the room often goes quiet. Backups only matter when they work, and they only work when they were designed with the failures you actually face in mind.
The 3-2-1 rule is a simple starting point that has stood up well for years. It is easy to explain to a board or owner and easy to check against what you have today.
3 copies of your important data: the original plus two backups.
2 different types of storage, so one failure does not take out everything. For example, a local appliance and a cloud service.
1 copy offsite, away from the building, so a fire, flood, tornado or theft does not destroy both the originals and the backups. Oklahoma and Texas operators know weather risk firsthand.
Many security teams now add a fourth idea: at least one copy should be immutable or offline, meaning ransomware cannot modify or delete it even if an attacker has administrator access.
Start with a list of systems, not servers. Ask which systems would stop operations if they disappeared.
EMR or EHR data, if hosted locally. If it is hosted by a vendor such as a cloud-based EMR, confirm in writing what the vendor backs up and how quickly they can restore. Do not assume.
File shares holding policies, care plan documents, scanned records, HR files and business office documents.
Email and calendars, which are often assumed to be safe because they are in the cloud. Cloud email providers generally do not guarantee recovery of deleted or encrypted content beyond limited retention windows, so check your plan.
Accounting and payroll data.
Phone system and nurse call configurations, so a replacement can be set up quickly.
Network device configurations for firewalls, switches and wireless access points.
Laptops and workstations only if staff save data locally, which is better to discourage.
Two terms help you decide how much protection you need.
Recovery point objective (RPO): how much recent data you can afford to lose. If you back up nightly, you could lose up to a day of work.
Recovery time objective (RTO): how long you can be down before it becomes a serious problem.
For example, a 90-bed facility might decide that the EMR needs a recovery time measured in hours, while archived HR files can wait several days. Writing these down tells your IT provider where to spend money.
Modern ransomware attackers look for backup systems early and try to delete them first. Reduce that risk with these steps.
Keep backup administrator accounts separate from everyday domain accounts, with multi-factor authentication.
Use immutable or write-once storage for at least one copy, with retention long enough to outlast a slow-burning intrusion.
Do not leave backup shares mapped as drive letters on user computers.
Encrypt backups, because they contain PHI and fall under the HIPAA Security Rule just like production data.
Alert on failed jobs and on any attempt to delete backup sets.
A backup that has never been restored is a hope, not a plan. Build a testing schedule:
Monthly: restore a few random files and open them to confirm they are readable.
Quarterly: restore a full server or database to an isolated environment and time the process.
Annually: walk through a full disaster scenario with leadership, including who makes decisions and how staff will document care on paper in the meantime.
Keep records of each test. They support the contingency plan requirements in the HIPAA Security Rule, which call for data backup, disaster recovery and emergency mode operation plans, and they are helpful when an insurer asks for proof.
Backing up to a USB drive sitting next to the server.
Relying on a single cloud sync folder, which copies deletions and encrypted files too.
Never updating the backup scope after adding a new system.
Having no documented restore procedure, so only one person knows how.
If you cannot answer where each copy lives, who can delete it and when it was last tested, that is your starting point. UnityCare IT designs and monitors backup and recovery for long-term care and healthcare organizations, and we can review your current setup against 3-2-1 and give you a plain-language gap list.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: 2524 N Broadway Ste 554 PMB 947974, Edmond, Oklahoma 73034