Healthcare organizations need more than backup copies to recover from ransomware: they need protected copies that attackers cannot easily alter, evidence that those copies restore cleanly, and a rehearsed plan for bringing patient-critical services back safely. For U.S. HIPAA-regulated covered entities and business associates, contingency planning includes backing up and restoring ePHI, continuing critical processes in emergency mode, and testing plans. HIPAA does not prescribe one universal backup product or architecture.
1. Decide what must be restored first
Map critical systems, data, and dependencies
Start with the services needed to deliver care and run essential operations, then identify the ePHI, applications, infrastructure, configurations, and dependent services each one needs. A clinical application may rely on identity services, network components, databases, interfaces, and specialized devices; recovering its files alone may not make the workflow usable.
As an Amazon Associate I earn from qualifying purchases.
Rank systems by criticality and patient-care impact, and document their dependencies. HHS contingency-planning guidance calls for an applications and data criticality analysis, while CISA recommends prioritizing critical assets, including systems that support health and safety. The resulting order should tell the recovery team what to restore, what it depends on, and what clinical or business process can resume when restoration is complete.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Set recovery targets for your environment
Set recovery point objectives (how much recent data the organization can tolerate losing) and recovery time objectives (how long a service can remain unavailable) according to risk analysis, care delivery needs, data-change rates, downtime tolerance, and available recovery capacity. There is no single appropriate backup frequency or recovery target for every provider. NIST SP 800-66 Rev. 2, published in February 2024, prompts organizations to assess whether backup frequency fits their environment.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
2. Keep recovery copies beyond an attacker’s easy reach
Ransomware operators may try to delete or encrypt backups they can access. HHS recommends considering offline copies, and CISA recommends offline, encrypted backups. The practical objective is to ensure at least one useful copy is not writable by the same compromised systems and identities that can change production data.
- Separate backup administration from production administration where the design allows it; protect privileged credentials and avoid reusing them across environments.
- Use network or account isolation suited to the organization’s architecture, and limit who can change retention, delete copies, or initiate restores.
- Encrypt backup data and protect the associated keys and access paths.
- Review logs for failed jobs, unexpected changes, deletions, and access that does not match the expected backup workflow.
Use 3-2-1 as a design pattern, not a compliance guarantee
HHS OCR’s October 2022 cybersecurity newsletter summarizes the 3-2-1 approach: keep three copies of important data (production plus two backups), use two media types, and keep at least one copy offsite. Examples of media include local disk, hosted cloud, and removable media. This is a general resilience pattern, not a HIPAA-mandated formula or a guarantee against ransomware; a copy still needs appropriate isolation, access control, and successful restore testing.
Understand the limits of immutability and synchronization
Immutable storage can help prevent alteration or deletion during a defined retention period, but it is not automatically safe: configuration mistakes, costs, and regulatory criteria can matter. An automated cloud backup or sync process can also copy encrypted files, while shared or compromised credentials may expose both production and recovery data. Assess the actual account, identity, retention, and deletion controls rather than assuming that “immutable cloud” by itself solves recovery.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
3. Back up what is needed to rebuild systems
Data files are only one part of a usable recovery. Include the artifacts needed to restore services, such as system images, operating systems, software, and configuration files. NIST SP 800-66 Rev. 2 asks organizations to consider whether backups or images of the operating systems, devices, software, and configuration files needed to support ePHI confidentiality, integrity, and availability are included.
CISA also recommends maintaining current golden images and keeping the software, source code, executables, licenses, and escrow information needed to rebuild systems where applicable. Keep recovery materials and documentation accessible to authorized responders even if ordinary production systems or identity services are unavailable.
4. Prove the backups can restore cleanly
A successful backup job does not prove that data is intact or that a service can return to operation. Review backup logs regularly and periodically perform actual restorations. HHS OCR’s Fact Sheet: Ransomware and HIPAA states: “Test restorations should be periodically conducted to verify the integrity of backed up data and provide confidence in an organization’s data restoration capabilities.”
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Set a testing cycle that fits the organization’s risk and recovery plan; the cited guidance does not prescribe one universal interval. Record results, gaps, owners, and corrective actions. Tests should establish which clean copy works, what dependencies are required, how long recovery takes under the exercise conditions, and whether staff can resume the essential workflow—not just whether a file can be opened.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Restore representative data and systems into a controlled environment, then check data integrity and usability.
- Exercise dependencies and access paths, including scenarios where production identities or networks cannot be trusted.
- Include technical recovery and operational decision-making in exercises; a tabletop discussion alone does not demonstrate that data can be recovered.
- Re-test material fixes so a documented gap is not mistaken for a resolved one.
5. Recover in a controlled order and keep care moving
Contain the incident before reconnecting systems
Follow the incident-response plan, contain the intrusion, and determine its scope before reconnecting affected systems. CISA advises using offline, encrypted backups according to critical-service priority and taking care not to reinfect clean systems. Review relevant logs and evidence, and rebuild or reimage affected systems from trusted sources when appropriate. Restore into a clean recovery environment rather than connecting compromised systems to recovery infrastructure.
Use emergency-mode procedures while systems are unavailable
HIPAA contingency planning includes procedures for continuing critical business processes in emergency mode. Prepare downtime workflows for clinical teams, including practiced paper-based processes where appropriate. HHS’s 405(d) healthcare ransomware resource recommends practicing pen-and-paper procedures; these are operational fallbacks, not substitutes for technical restoration.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Define who authorizes recovery steps, who validates clinical readiness, how staff receive status updates, and how work performed during downtime will be reconciled after systems return. These decisions should be exercised alongside technical restoration so that restored technology translates into safe, usable care.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Treat cloud backup as a shared-responsibility decision
A U.S. covered entity or business associate may use a cloud service to create, receive, maintain, or transmit ePHI when it conducts the required risk analysis, enters a business associate agreement (BAA) with the cloud provider when that provider acts as a business associate, and otherwise complies with HIPAA. HHS cloud guidance notes that service-level agreements may address availability, reliability, backup, and data recovery. Cloud use does not remove the organization’s responsibility to understand its own obligations and recovery design.
Before relying on a cloud recovery copy, establish who controls each part of the process:
Best Value
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- Backup configuration, retention, deletion protection, and restore initiation.
- Identity and access management, including separation from production credentials.
- Encryption and control of keys.
- Incident communications, support availability, and recovery time commitments.
- Responsibilities and evidence for restoring the organization’s particular clinical systems and data.
Confirm that an attacker using compromised production credentials cannot simply delete every recovery copy. Review the actual service and account architecture, contract terms, and BAA applicability; general guidance does not validate any particular vendor or product.
7. Assess breach obligations separately from data recovery
Restoring from backup can help mitigate harm to ePHI integrity, but it does not establish whether protected health information was accessed or exfiltrated, and it does not by itself settle breach notification. HHS OCR treats a ransomware attack as a security incident; whether it is also a breach under the HIPAA Rules is a fact-specific determination. Coordinate incident response, privacy, and legal teams to assess the facts and any notification obligations. Working backups do not automatically eliminate reporting duties.
HHS OCR’s April 2026 enforcement release described four ransomware-related HIPAA Security Rule settlements and investigations affecting more than 427,000 individuals. That is a dated enforcement snapshot, not a measure of ransomware prevalence or proof that a particular backup configuration will avoid enforcement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
