Chapter 8 — Backup, ransomware and recovery

Chapter 8 — Backup, ransomware and recovery

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Backup design"]
  N2["8.2 Recovery objectives"]
  N3["8.3 Testing"]
  N4["8.4 Clinic continuity"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Backup design"]
  N2["8.2 Recovery objectives"]
  N3["8.3 Testing"]
  N4["8.4 Clinic continuity"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 Backup design]
    |
    v
[8.2 Recovery objectives]
    |
    v
[8.3 Testing]
    |
    v
[8.4 Clinic continuity]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) design backups resistant to ransomware; (2) test recovery against objectives; (3) plan clinic continuity.

8.1 Backup design

Moorfield backs up the patient record system nightly to a server in head office, reachable from the same network. Elena recognises that ransomware could encrypt both. She adds immutable copies held by a backup provider for thirty days, which cannot be deleted even by Moorfield administrators. She also separates backup administration credentials from everyday administrator accounts. Dr. Qureshi notes that ransomware groups often target backups first, so backups must be designed against deliberate attack, not just accidents. The board approves the provider's annual cost.

8.2 Recovery objectives

Elena agrees objectives with the clinical lead and operations director, consistent with the board's appetite. The patient record system must return within four hours and lose no more than one hour of data. Imaging must return within one day; clinics can continue with paper notes meanwhile. Email can wait a day. She learns that objectives must be agreed with those who bear the consequences, because technical teams alone tend to underestimate or overestimate the urgency. The objectives are recorded in the recovery plan and signed by both managers.

8.3 Testing

Elena tests a full restore of the patient record system into an isolated environment. The restore succeeds but takes six hours, missing the four-hour objective, mostly because the database is copied slowly from the provider. She arranges a faster recovery option: a recent snapshot kept locally on immutable storage. A second test completes in three hours. She learns that only timed tests reveal whether objectives are achievable. She records both test timelines step by step and adds the local snapshot procedure to the recovery runbook, so any member of the central team can follow it.

8.4 Clinic continuity

Elena works with clinic managers on continuity plans for system outages: printed appointment lists each evening, paper clinical notes with later entry and emergency contact details for patients with appointments. A clinic trials the plan during a planned system upgrade and identifies that paper consent forms were missing. The forms are added. Dr. Qureshi notes that continuity planning keeps patient care going while technical recovery happens. Each clinic keeps a small continuity box containing printed forms, the latest appointment list and contact numbers, and clinic managers check its contents every month.

Worked example

Elena adds thirty-day immutable backups and separate credentials, agrees recovery objectives, improves a six-hour restore to three hours and trials clinic paper fallbacks.

Synthetic case. Tests are synthetic.

Errors and limits

Backups reachable with everyday administrator credentials can be destroyed by ransomware.

Exercises

• EX036 — Immutable period. How long are immutable copies held? Rubric: 3 = thirty days;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX037 — Record objectives. What are the patient record objectives? Rubric: 3 = four hours, one hour of data;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX038 — First test. How long did the first restore take? Rubric: 3 = six hours;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX039 — Second test. How long did the second test take? Rubric: 3 = three hours;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX040 — Missing forms. What was missing in the continuity trial? Rubric: 3 = paper consent forms;; 2 = partly correct;; 1 = other;; 0 = none.

Continue studying — lesson 08 (chapter 08 of 12)

← Chapter 07 · Course chapter index · Chapter 09 →

Continue to the next authored lesson.