Under Ontario's PHIPA, health information custodians must take reasonable steps to protect personal health information against theft, loss and unauthorised use. For backups, that practically means an encrypted copy stored off-site, run every night, with restores that are actually tested. Many clinics also prefer to keep data in Canada. This is practical IT information, not legal advice.
What a sound clinic backup includes
- Encrypted, so a lost copy is unreadable without the key
- Off-site, away from the clinic's computers and network
- Nightly, so at most a day of work is at risk
- Restore-tested, so you know the data comes back
- Covers your EMR or practice software data, not just documents
Common gaps we find
- A USB drive next to the server or taken home unencrypted
- A backup job that has been failing quietly
- Backups nobody has ever restored from
- A backup reachable from the clinic network, so ransomware can encrypt it too
The 3-2-1 approach, in clinic terms
A simple rule of thumb: keep three copies of your data, on two different kinds of storage, with one copy off-site. For a small clinic that usually means the live data on the computer or server, a local copy for fast restores, and an encrypted cloud copy stored in Canada. If your practice software is cloud-hosted, ask the vendor how they back up your data and whether you can get an export.
How to test a restore
At least a few times a year, restore a sample: a folder of scanned documents, a mailbox or a copy of the practice database to a test location. Confirm the files open and note the date and result. A backup that has never been restored is only a hope.
Questions to ask your IT provider
- Where exactly is our backup stored, and is it in Canada?
- Who holds the encryption key?
- When did the last backup succeed, and how would we know if it failed?
- When did you last test a restore, and what did you restore?
- Could ransomware on a clinic PC reach the backup?
Backups are one safeguard
PHIPA also covers policies, access control, training and breach response. For legal questions, speak with your privacy advisor or your regulatory college.