Ask a practice whether they back up their patient records and the answer is almost always yes. Ask when they last restored from that backup and the answer is almost always never.

An unrestored backup is a belief, not a safeguard. The failure modes are quiet: a scheduled job that stopped running after an update, a drive that filled up, a file that has been copying successfully but is corrupt, a cloud sync that was paused by someone who did not know what it was.

Three copies, two places, one off site

The old rule holds and adapts well to Nigerian conditions. Three copies of the data. On at least two different kinds of storage. At least one physically away from the clinic.

The off-site copy is the one that matters most and is skipped most often. A backup drive sitting next to the server protects you from a disk failure. It does not protect you from theft, fire or flooding, which are the events that destroy a practice.

What to ask a cloud vendor

If your EMR is hosted, backup is the vendor's job, which does not mean it is done to a standard you would accept. Ask, and get it in writing:

  • How often are backups taken
  • How long are they retained, and can you recover a record as it was a month ago
  • How long would a full restore take
  • Have they tested a restore, and when
  • Can you export your own complete data, on demand, in a usable format

That last question is the important one. A practice that cannot extract its own data is dependent on the vendor continuing to exist and continuing to be agreeable. Take a full export periodically and keep it yourself, regardless of what the contract promises.

Test the restore

Once a quarter, restore a backup to somewhere that is not production and confirm that it opens, that the data is current, and that it is complete. Note how long it took, because that number is your real recovery time and it is usually longer than anyone assumed.

Write the date and the result down. This log is what turns a belief into a verified control.

Ransomware changes the calculation

A backup connected to the same network, permanently mounted, will be encrypted along with everything else. At least one copy needs to be disconnected, or held in storage that cannot be overwritten by a compromised machine.

Write the recovery procedure down

The person who understands the backup is often one person, and disasters do not schedule themselves around their availability. A written procedure covering what to restore, from where, in what order, and who to contact, kept on paper as well as on a computer, is what makes recovery possible without them.

None of this is expensive. It is simply work that produces nothing visible until the day it produces everything.