Health Clinics
When the EHR Is Down, the Clinic Still Has to See Patients.
The HIPAA Security Rule asks every clinic for a contingency plan: backups, a way to restore, and a way to keep working while systems are down. We build the technical half and prove it restores.
For clinics that cannot check in a patient, write a prescription or bill a visit without their data.
Backup and Ransomware Recovery for Health Clinics
What Does the HIPAA Contingency Plan Require?
Policies and procedures for responding to an emergency that damages systems containing ePHI, such as fire, system failure or a natural disaster (45 CFR 164.308(a)(7)). Three parts are required: a data backup plan that keeps retrievable exact copies of ePHI, a disaster recovery plan to restore any loss of data, and an emergency mode operation plan to keep critical processes going.
Two parts are addressable: testing and revision of the plan, and an analysis of which applications and data matter most. We test anyway, because an untested plan is the one that fails.
Our EHR Is in the Cloud. What Do We Still Need to Back Up?
More than most clinics expect. The EHR vendor holds the chart, so ask them how they back it up and how you would get your data out. Everything else is yours: scanned documents and forms on local machines, shared files, Microsoft 365 mailboxes full of referrals, and any on-site server for imaging, billing or an older system.
We back up servers, key workstations, cloud mailboxes and shared files, encrypted and stored off-site, with daily backups and restore options.
What Is Emergency Mode, in Practice?
It is the plan for the morning the EHR will not load. Picture a clinic opening on a Monday with a full schedule and a ransom note on the front desk computer. With a plan, staff know which downtime forms to use, who has today's schedule printed or exported, how urgent prescriptions are handled, and who calls whom. Without one, the first hour is improvised.
We help write the technical side of that plan: what is restored first, in what order, and how long each step takes.
How Do You Keep Ransomware From Reaching the Backups?
Layers in front of them: endpoint detection and response, application allow-listing, patching and staff training make an infection less likely to start or spread. The off-site, encrypted copy is kept apart from the office network, so ransomware on the front desk computer does not take the backup with it. If it happens anyway, we contain it and restore from a clean copy.
What Is Included
6 PARTSOff-Site Encrypted Backups
Clinic data encrypted and stored away from the office network.
Cloud Mailbox and File Backup
Microsoft 365 mail and files, where referrals and forms often live, included in the plan.
Tested Restores
Restores tested and recovery procedures validated, before the day you need them.
Backup Monitoring
Every failed job raises a ticket to our team.
Ransomware Protection
EDR, allow-listing and patching in front of the backups.
Incident Response Plan
A written plan, so the first hour of an outage is not improvised.
Frequently Asked Questions
4 QUESTIONSDoes HIPAA require a data backup plan?
Yes. The data backup plan is a required implementation specification of the contingency plan standard: procedures to create and maintain retrievable exact copies of ePHI (45 CFR 164.308(a)(7)(ii)(A)).
If our EHR vendor backs up the chart, are we covered?
Not entirely. Ask the vendor how they back up and how you would export your data. Scanned documents, shared files, mailboxes and any on-site server are still the clinic's to protect.
Is a ransomware attack a HIPAA breach?
It can be. A breach of unsecured protected health information triggers notice to affected individuals within 60 calendar days of discovery (45 CFR 164.404(b)). Whether a specific incident is reportable is a determination to make with your counsel.
How often are backups taken?
Daily as a baseline, and more often for systems that change constantly. We scope it around how much clinic work you can afford to lose.
More for Health Clinics
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Health Clinics
Virtual CISO (vCISO)
Senior security leadership, a roadmap and governance, without a full-time hire.
Health Clinics
Managed IT and security for medical clinics, with the HIPAA Security Rule safeguards run every day.
Talk Through Your Clinic's Backups.
Pick a time. Tell us which systems the clinic cannot open the doors without.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.