Backups in hospitals and clinics: PACS and ransomware

Backups in hospitals and clinics must cover the database of the hospital information system (HIS) that holds the medical records. If you carry out imaging, you also need a backup of the picture archiving and communication system (PACS). Protect the servers and configuration too: without them the system cannot be brought back quickly.

Backups have to be kept in more than one place. At least one of them must be isolated so that ransomware (malicious software that encrypts data for a ransom) cannot encrypt or delete it. Restores have to be tested regularly. A backup that nobody has ever tried to restore a system from is only an assumption that the backup works.

Which systems and data need protecting?

System or data	Why it is critical	What to watch out for
HIS database	medical records, registration, billing	a consistent database backup; copying the files on disk is not enough
PACS archive	X-ray, CT, MRI and ultrasound images	large and constantly growing volume
RIS (radiology information system), LIS (laboratory information system) and other clinical systems	orders, reports, results	dependencies between systems, restored together
Servers and virtual machines	operating system, service configuration	restoring a whole machine is faster than reinstalling from scratch
Files and scans	digitised paper documents, consents, contracts	often stored outside the HIS
Network device configuration	firewall, switches, VPN	without it, rebuilding the network takes much longer

If you use a cloud system, the provider takes over part of this list. Still, check the scope of its backups and the restore time written into the contract. We describe the differences between the cloud and your own server, using Optimed NXT as an example, in our article Optimed NXT: cloud or on-premises server?.

The 3-2-1 rule in practice

The 3-2-1 rule says: three copies of the data, on two different types of media, with one of them off site. In a hospital or clinic this usually means:

• production data on the server
• a local backup on a separate device (for example a backup server or a NAS), which is the fastest to restore from
• a backup outside the building, at a second location or in the cloud

With today’s ransomware attacks, two additions matter more than the number of copies. The first is at least one copy that is immutable or disconnected from the network. The second is a regular restore test, which we describe below.

How do you protect backups from ransomware?

Ransomware increasingly looks for backups on purpose and tries to delete them before encrypting the data. That is why we configure backups so that taking over a computer or an administrator account in your network does not give access to every copy:

• separate credentials for the backup system, different from domain accounts
• an immutable repository, in which backups cannot be changed or deleted before a set period expires
• a copy outside the local network or physically disconnected
• MFA (multi-factor authentication) for the backup system console
• a separate network segment for backup servers; we describe how we build such networks on our network infrastructure page
• alerts about failed backups and unusual changes, for example a sudden increase in the amount of changed data

A separate plan for the PACS archive

The PACS archive grows with every study, and CT and MRI studies take up a lot of space. A full nightly backup of the whole archive is usually not possible. That is why PACS backups are planned incrementally, and storage for the coming years is reserved in advance.

The retention period follows from the law. The Act on Patient Rights and the Patient Ombudsman (in Polish), Art. 29, requires medical records to be stored, as a rule, for 20 years from the end of the year of the last entry. For X-ray images stored outside the patient’s records, the period is 10 years (with a few exceptions, legal status as of 8 November 2026). When planning capacity, agree with the head of the healthcare provider which data is subject to which period.

How do you test a restore?

A restore test checks whether the system can be started from the backup and whether the data is complete. Before the test we agree two parameters:

• RPO (Recovery Point Objective): how much data you can afford to lose, measured as the time since the last backup
• RTO (Recovery Time Objective): how long the system can be unavailable before the work of reception and doctors is seriously disrupted

We run the test in an isolated environment so that it does not disrupt production work. Record the result of the test, meaning the restore time and any problems. Such a record is also evidence that you assess the effectiveness of your safeguards periodically.

Regulations on protecting medical records

The Regulation of the Minister of Health of 6 April 2020 on the types, scope and templates of medical records and the manner of processing them (in Polish; consolidated text, Journal of Laws 2026, item 1391) does not use the word “backup”, but it requires, among other things (legal status as of 8 November 2026):

• systematic risk assessment and documented procedures for protecting records (§ 1(5)(1)–(2))
• ongoing monitoring of safeguards and periodic assessment of their effectiveness (§ 1(5)(5))
• plans for storing records over the long term (§ 1(5)(6))
• conditions that protect records against destruction, damage or loss (§ 1(7))

An incident such as a ransomware attack may lead to a personal data breach. The controller then notifies the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. Notification is not required if the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Art. 33 GDPR). Tested backups shorten the interruption to work, but they do not remove the need to assess the breach.

Backups as part of our IT support for clinics

We implement backups of devices and the most important systems as part of our IT support for clinics and medical centres. We are a partner of Veeam, Synology and QNAP. We carry out backup deployments together with the team of Conetso Group, the business IT brand of the same company (CONETSO GROUP Sp. z o.o.), and the scope is described on the hardware and server solutions page (in Polish).

We start every backup review with a restore test. Write to us to arrange one.