How should a dental practice back up patient data?

Key facts

What does HIPAA actually require for backups?

Under the Security Rule's contingency plan standard, three pieces are required:

• Data backup plan: procedures to "create and maintain retrievable exact copies" of ePHI
• Disaster recovery plan: procedures to restore any loss of data
• Emergency mode operation plan: how you keep critical processes running, and ePHI protected, during an emergency

Testing and revising those plans, and ranking which applications and data matter most, are "addressable" (45 CFR 164.308(a)(7)). Addressable doesn't mean optional. It means you implement it if reasonable and appropriate or document an alternative (HHS). For a dental office, there's no good argument against testing restores.

To see this on your own floor plan, FloorStack Studio (live, free plan) builds a 3D IT plan of your office with every device placed.

What exactly needs to be backed up?

More than the PMS database. CISA tells businesses to start by inventorying what important information is on the network (CISA). In a dental office that usually means:

Open Dental's server footprint, for example, includes the database plus its "A to Z" image and document folder (Open Dental). Both need to be in the backup.

What does 3-2-1 look like in a dental office?

CISA defines it as three copies of important files, on two different types of storage (such as a hard drive and the cloud), with one copy off-site. It also says backups should run automatically (CISA). A common practical layout:

1. Copy 1, production: the live server (ideally on mirrored drives; Eaglesoft's spec calls for RAID 1 (Patterson)). RAID protects against a failed drive. It is not a backup.
2. Copy 2, local backup: a backup appliance or NAS in the rack for fast restores.
3. Copy 3, off-site and isolated: encrypted cloud backup with immutability or object lock, or a rotated offline drive.

CISA's ransomware guidance explains why the third copy has to be isolated. "Many ransomware variants attempt to find and subsequently delete or encrypt accessible backups" (CISA #StopRansomware Guide). CISA also suggests delete protection, object lock and versioning on cloud storage.

How often should backups run, and how far back should they go?

Set it from two numbers. The recovery point objective is how much data you can afford to lose. The recovery time objective is how long you can be down. CISA recommends refining both with scheduled recovery tests, and being able to roll data back at least seven days (CISA).

For a practice seeing patients all day, losing a full day of charting and imaging is painful. Many practices back up the database several times a day and imaging nightly.

How do I know the backups actually work?

Restore from them. CISA tells businesses to test that the team can restore data "both fully and partially" (CISA), and its ransomware guide calls for regularly testing backup availability and integrity in a disaster recovery scenario (CISA #StopRansomware Guide).

A useful quarterly test for a dental office:

• Restore yesterday's PMS database to a test machine and open a patient chart
• Restore one CBCT volume and one pano from 30 days ago
• Time the full restore and compare it to your recovery time target
• Write down the result. That record is part of your HIPAA documentation, which must be kept for six years (HHS)

What if my IT company manages the backups?

That's common, but it shouldn't mean you're blind. HHS's 405(d) guide for small healthcare organizations says to make it a requirement that any prospective MSP set up offline, off-site, encrypted backups (HICP Technical Volume 1). CISA adds that if a third party or MSP maintains your backups, you should make sure they follow these practices and put the requirements in the contract (CISA).

Also confirm two things in writing. First, the backup vendor and MSP have signed a BAA. Second, the backup account is in the practice's name, with admin access you control. A backup you can't log into without your MSP is a backup that can be withheld. See what your IT contract should say.

To turn this into a drawing your low-voltage contractor can bid, the free network & IT plan generator (coming soon) is planned to produce drops, rack, Wi-Fi and VLAN plans from your floor plan.

To list every account the practice should own, the free credential ownership checklist (coming soon) will include a "password hostage" letter template you can adapt.

Does a cloud PMS mean I don't need backups?

You need fewer, not none. With cloud software the vendor protects the PMS data, but local imaging, scanner files, email and device configs are still yours. HHS's cloud guidance suggests addressing backup, data recovery and how data is returned at termination in the service level agreement (HHS). See server vs. cloud.

How FloorStack helps

On the FloorStack dental build-out platform, the free Studio plan puts the backup appliance, UPS and off-site path on your rack layout, and lists every device that stores data so nothing gets left out of the backup scope. The planned Credential Ownership Checklist (free tool, coming soon) will include confirming that the backup account is in the practice's name. Start a free Studio plan or go to the Dental Office IT Setup hub.

Free tools on the FloorStack dental build-out platform for this step: Network & IT plan generator (free tool, coming soon) and Credential ownership checklist (free tool, coming soon).

Free tools for this step

• FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
• Network & IT plan generator (free tool, coming soon): turn your floor plan into a drops, rack, Wi-Fi and VLAN plan.
• Credential ownership checklist (free tool, coming soon): list every admin account the practice should own, with a "password hostage" letter template.