I want to tell you something which you need to know, because I think you already feel it somewhere: having a backup and having a working backup are two very different things.
Most clinic owners I talk with believe they are covered. Someone set up a backup system a few years ago. It runs quietly in the background. Nobody thinks about it — until the day they need it.
Does that keep you awake at night?
A story that still breaks my heart
In 2019, a small two-doctor ear, nose, and throat practice in Michigan called Brookside ENT was hit with ransomware. The attackers locked up their patient records, billing, and appointment history, and demanded payment to unlock it. The doctors made the hard call not to pay, in part because there was no guarantee the criminals would actually hand over a working key. But when they went looking for a backup to fall back on, there wasn’t one they could use. The practice closed its doors for good that same year. One mother, trying to schedule her daughter’s follow-up surgery appointment, found out her daughter’s entire surgical history was simply gone.
Around the same time, a California practice called Wood Ranch Medical went through something even harder. Their backups were connected to the same network as their regular files, so when ransomware struck, it encrypted both at once. With no way to recover their patients’ medical histories, the clinic made the painful decision to close permanently.
I share these stories not to scare you. You already carry enough weight. I share them because both of these clinics likely believed, right up until the moment it mattered, that they had backups. The problem wasn’t that they never thought about backups. The problem was that no one had ever tested whether those backups would actually work when it counted.
Why “we have backups” isn’t the same as “we’re protected”
A backup is really just a snapshot in time of your data sitting somewhere. That’s it. It doesn’t tell you:
- How long it would take to actually get your systems working again
- Whether the backup is even recoverable, or just quietly corrupted
- Whether it’s stored somewhere the same attack could reach
Security experts who reviewed the Brookside ENT closure afterward gave a simple piece of advice: keep backup copies that are disconnected from your main network, and test them regularly. Not because it’s technically impressive. Because it’s the only way to actually know your safety net will hold.
You deserve to know, not just hope
I understand why testing backups feels like one more thing on an already overwhelming list. You’re thinking about patients, staffing, marketing, and a hundred small fires every single day. Backup testing isn’t why you got into healthcare.
But here’s the reassuring part: this doesn’t have to fall entirely on you. A good technology partner can quietly test your recovery process on a regular schedule and simply tell you, “Yes, this works,” or “Here’s what we fixed before it became a problem.” You shouldn’t have to be the one lying awake wondering.
Your next step
If you’re not sure the last time your backups were actually tested — not just running, but tested — that’s a completely normal place to be. Most clinic owners are in that same spot.
You don’t need to panic. You just need someone to check, quietly and thoroughly, and tell you the truth about where you stand. That’s what protects your patients, your staff, and the practice you’ve worked so hard to build.
You deserve to know your clinic could keep going, even on its hardest day.
