Here’s a question I like to ask clinic owners, gently, over coffee: if your systems went down right now, this second, would you know exactly what happens next? Or would you be finding that out in the moment, in front of a waiting room full of patients?
Most people go quiet when I ask that. Not because they haven’t thought about technology. It’s because they’ve thought about the plan, but never actually walked through it.
Having a plan and testing a plan are not the same thing
I understand why. Life in a clinic moves fast. Between patients, staff, and a hundred small decisions a day, sitting down to “test” a recovery plan can feel like a luxury you don’t have time for.
But I think about small healthcare practices like Brookside ENT in Michigan, and Wood Ranch Medical in California, both of which closed permanently after ransomware attacks in 2019 wiped out their patient records. In both cases, the loss wasn’t only about the attack itself. It was about discovering, in the middle of a crisis, that the safety net everyone assumed was there either didn’t work or wasn’t reachable. That is the kind of discovery no clinic owner should have to make on the worst day of their career.
A plan that has never been tested is really just a hope. And while hope is a wonderful thing, it isn’t a strategy.
What “testing” actually looks like — and why it’s not as scary as it sounds
I want to take some of the mystery out of this, because I think the word “testing” makes people picture something complicated and technical. It doesn’t have to be.
A simple tabletop drill just means sitting down once or twice a year with your team and your IT partner, and walking through a “what if.” What if we lost access to our scheduling system for a day? What if a staff member accidentally deleted a folder of patient files? What if we couldn’t get into our email for 48 hours?
You talk through it. You figure out who does what. You find the gaps while nothing is actually on fire.
Two questions matter most in these conversations, and I promise they’re simpler than they sound:
- How long would it take to get back up and running? This is sometimes called your Recovery Time Objective, but really it’s just: how many hours or days would my clinic be stuck?
- How much recent information could we lose and still be OK? This is your Recovery Point Objective — basically, are our backups granular (frequent) enough to be usable to recover from a sudden problem?
When you know the honest answers to those two questions, the fear starts to shrink. Uncertainty is what makes disasters feel so heavy. Clarity is what makes them be more manageable.
Why this protects more than your data
When I talk with clinic owners, the fear underneath the fear is almost never really about computers. It’s about patients losing trust. It’s about staff feeling scared and unsupported. It’s about the reputation you’ve spent years building.
A tested recovery plan protects all of that. It means that if something does go wrong, your team already knows what to do. Nobody is improvising in a panic while patients wait.
You don’t have to carry this alone
If you’ve never walked through a “what if” with your team, please don’t feel behind. Most practices haven’t. What matters now is simply starting.
A good technology partner can lead this process for you, so it becomes a supportive conversation rather than one more task on your plate. You bring the knowledge of how your clinic runs. They bring the structure to test it safely, before a bad Monday ever arrives.
Because you deserve more than hope. You deserve to actually know your clinic would be okay.
