Backup and Recovery Planning: Ask for Restore Evidence

1. Map the information you need to recover

List EHR information, shared files, scanned documents, billing data, configuration records, and other systems your practice depends on. Name the provider and practice contact for each. Ask which copies exist, what they include, how long they are retained, and what is excluded.

For hosted applications, confirm what recovery the vendor manages and what your practice must arrange. Do not assume synchronization, deleted-item retention, or a subscription includes every recovery capability you need.

2. Set planning targets for each workflow

Discuss two questions with practice leadership and the relevant providers: how long can this workflow remain unavailable, and how far back could the recovered information be? Recovery time objective (RTO) concerns the recovery period; recovery point objective (RPO) concerns the point in time to which data must be recovered.

Record the practice’s targets alongside the provider’s documented arrangements and any test results. These are different facts. A target is not a guarantee, and a backup schedule by itself does not establish the time needed to resume work.

3. Ask for backup evidence

Request a dated report identifying the protected systems, completed and failed jobs, latest usable recovery points, retention settings, and who responds to failures. Ask how backup access is protected and how copies are kept separate from a compromised working environment. CISA recommends offline, encrypted backups and testing their availability and integrity.

4. Agree a controlled restore exercise

Have the responsible technical team plan a restore in an appropriate isolated environment, with authorized access and protection for sensitive information. A practice reviewer should check the agreed result is usable. Restoring one file demonstrates less than recovering an application and its dependencies.

• Record the date, scenario, backup selected, systems included, and people involved.
• Record elapsed time, checks performed, missing items, and dependencies that delayed recovery.
• State exclusions and assign corrective work; do not describe a partial exercise as complete recovery proof.

5. Prepare for the period without access

Keep reachable support contacts and a practice-approved downtime procedure available if normal systems are unavailable. Assign communication and work-reconciliation roles. HealthIT.gov’s SAFER resources address planned and unplanned EHR unavailability; use the relevant guidance with your clinical and administrative leads. Review the plan when systems or responsibilities change.