Utah medical practices face a familiar mix of disaster risks. Winter storms knock out power along the Wasatch Front. Spring runoff can flood lower-level offices. Wildfire smoke and summer heat strain equipment. And like practices everywhere, Utah clinics face a growing threat from ransomware.
Any of these events can make your electronic health record unavailable. When that happens, a practice still has patients in the waiting room, prescriptions to manage, and appointments to keep. A strong disaster recovery plan is what keeps a bad day from becoming a bad month.
What HIPAA Expects
The HIPAA Security Rule includes a contingency plan standard. Covered entities must have a data backup plan, a disaster recovery plan, and an emergency mode operation plan. The rule also addresses testing those plans and identifying which applications and data are most critical.
For a small practice, that doesn't mean a binder the size of a phone book. It means having clear, written answers to how you'll protect patient data, restore systems, and keep caring for patients during a disruption.
Five Ways to Strengthen Your Practice's Recovery
1. Know where your patient data actually lives
Many Utah practices now use cloud-based EHRs. That shifts some backup responsibility to the vendor, but not all of it. You still need to know:
- How often your EHR vendor backs up data, and how quickly they can restore it.
- Whether local systems, such as imaging, lab interfaces, or scanned documents, are backed up separately.
- What happens if your office internet goes down even though the EHR is working fine.
2. Protect at least one backup from ransomware
Ransomware attackers deliberately look for backups to delete or encrypt. Keep at least one backup copy that's offline, immutable (meaning it can't be changed), or otherwise isolated from your everyday network.
3. Plan for internet outages, not just disasters
For cloud-based practices, a cut fiber line can be as disruptive as a server failure. A backup internet connection, often a cellular option, can keep the front desk and providers connected through common outages.
4. Prepare an EHR downtime kit
Every practice should have a simple downtime kit that staff can use when the EHR is unavailable:
- A printed or offline copy of the day's schedule, updated each evening.
- Paper encounter forms and prescription pads where permitted.
- A list of key phone numbers for pharmacies, labs, and referral partners.
- Instructions for entering paper records once systems return.
5. Test the plan
Testing doesn't have to interrupt patient care. Try restoring a single file or a test database after hours. Run a short tabletop exercise during a staff meeting: "It's 8 a.m. and the EHR is down. What do we do?" You'll quickly find gaps.
Setting Recovery Targets
Two terms help practices decide how much protection they need:
- Recovery time objective (RTO): how long a system can be down before patient care or operations are seriously affected.
- Recovery point objective (RPO): how much data you could afford to lose and re-enter, measured in time.
A practice might decide the EHR needs to be back within four hours, while the shared drive for administrative documents can wait a day. Those decisions guide what kind of backup and recovery tools make sense.
Regional Considerations for Utah Practices
Utah practices should consider risks specific to their area:
- Earthquake planning: The Wasatch Fault runs beneath many Utah communities. Store offsite or cloud backups somewhere that wouldn't be affected by the same local event.
- Winter weather: Plan for staff who can't get to the office and for providers who may need secure remote access.
- Multi-location groups: Practices with clinics in Salt Lake, Davis, Weber, and Cache counties should decide whether one location can temporarily support another.
A Utah Practice Disaster Recovery Checklist
- Written backup, disaster recovery, and emergency mode plans.
- At least one ransomware-resistant backup copy.
- Confirmed EHR vendor recovery commitments.
- Backup internet connection.
- EHR downtime kit at every location.
- At least one test per year, documented.
Keep Caring for Patients When Systems Fail
Disasters rarely give advance notice. The practices that recover fastest are the ones that planned on a calm day. Maise Technology helps healthcare organizations build recovery plans through our disaster recovery services. You can learn more about our healthcare work on our IT services for healthcare organizations page, and about our local support on our Salt Lake City managed IT services page.
Want to review your practice's recovery readiness? Schedule A 15 Minute Discovery Call.
This article is for general information and is not legal advice regarding HIPAA compliance.
