Every morning, the backup software at many practices reports that last night’s job completed successfully. Nobody has ever tried to get a patient chart back from it.
That check mark proves data was copied, not that the copy is complete, out of an attacker’s reach or restorable by anyone on staff. Ransomware is a bad day to find out.
What’s actually happening in 2026
Having backups isn’t the same as being able to restore them. In Sophos’s State of Ransomware in Healthcare 2025 (October 2025), healthcare providers whose data was encrypted used backups to restore it in only 51% of incidents, Sophos’s lowest rate in four years.
Sophos said its findings point to “possible weaknesses or a lack of confidence in backup resilience,” and 36% of victims paid the ransom to get data back. The survey covered 292 healthcare IT leaders in 17 countries at organizations with 100 to 5,000 employees, so it isn’t small-practice data.
Sophos’s July 2026 U.S. report (377 ransomware-hit organizations, not just healthcare, same size range) found 60% used backups to recover encrypted data, up from 43% a year earlier, while 56% paid the ransom and got data back. Its advice: backups “should be tested regularly, stored offline or in immutable formats.”
Cloud services have limits too: Microsoft 365 keeps permanently deleted email for 14 days by default (adjustable to 30), and its point-in-time backup is a separate pay-as-you-go service.
Why this is a HIPAA problem, not just an IT problem
The HIPAA backup requirements are short: the Security Rule requires a data backup plan that creates and maintains “retrievable exact copies” of electronic patient data, and a disaster recovery plan to restore any loss of data (45 CFR 164.308(a)(7)(ii)(A) and (B)). Until you’ve restored from a backup, you can’t show it’s retrievable.
Periodic testing of contingency plans is “addressable,” which doesn’t mean optional: you must do it if it’s reasonable and appropriate, or document why not and, where reasonable, adopt an equivalent measure (45 CFR 164.306(d)(3)). HIPAA sets no testing frequency, but OCR’s 2016 ransomware guidance says test restorations should be conducted periodically.
A cloud EHR or IT vendor holding your patient data is a business associate and must sign a business associate agreement (BAA); ask separately how its backups and restores work.
OCR’s January 2025 Security Rule proposal would require plans to restore critical systems within 72 hours and contingency plan tests at least every 12 months, but it’s only a proposal: GovInfoSecurity reported in July 2026 that final action isn’t planned before July 2027.
What to actually do about it
Prove one restore works, then make it routine.
- Put restore tests on the calendar: restore one patient file and one full system, such as the EHR server, and time both; only a real restore shows how long you’d be down.
- Keep one copy offline or immutable, with separate logins: OCR warns that some ransomware removes or disrupts online backups, and immutable storage makes tampering harder, not impossible.
- Get your vendors’ backup terms in writing: ask your cloud EHR and Microsoft 365 providers what they back up, how far back they can restore and how you’d get your data out; default retention can be just two weeks.
- Write the restore order into your downtime plan: HIPAA asks you to assess which applications and data are most critical, so decide what comes back first and who restores it; our ransomware response plan shows a typical sequence.
- Record every test: log the date, what was restored, how long it took and what failed; that’s your evidence of testing, and the gaps belong in your HIPAA risk assessment.
Where ACS fits in
ACS’s free 30-minute IT & HIPAA assessment checks where your backups live, whether one copy sits out of an attacker’s reach, when a restore was last tested and what your cloud vendors cover. If nobody owns restore tests month to month, that’s part of managed IT services for medical practices; see managed IT pricing for costs.
