When we valuate practices, we are continually surprised by the lack of formal procedures surrounding the backup and retention of computer information. Just about all practices backup their computers every night but the similarity ends there. Too often the backup tapes are left in the computer or beside the computer. With up to a year of bookings and tens of thousands of dollars in accounts receivables being stored only on the computer and the tapes beside the computer, there is an unnecessary risk of theft and/or fire that would wipe out all this documentation.
The computer is easy enough to replace but the data is not. The cost could easily reach $100,000 in lost appointments, lost accounts receivable and staff time and effort to rebuild the database if it is even able to be rebuilt. There should be a firm, documented set of instructions on backup procedures which are kept up-to-date. This policy should include a periodic review of the backup medium to ensure that the backup data is actually recorded. We have valued a few practices that have had a crash of the hard drive and the backup tapes were blank. It then took them anywhere from six months to a year to get over the problem.
Computer Theft
By far the greatest risk is computer theft. Two practices we valued have had their computers stolen three times. The first time was to take the old computers, which the thieves knew would be replaced by new, state-of-the-art computers which were then stolen a second and third time. This happened even though both practices had alarms installed and armed.
Theft is so quick and easy that the police do not have time to respond. One practice put in an alarm system and iron bars on the windows, despite being located in an area that wasn’t considered high-crime. It’s critical that tapes or other backup media are not available to the thieves. The most current backup data should be stored off sight.
Here are some suggestions to minimize the loss of sensitive patient information:
- Formalize the procedures regarding backup that cover the long-term protection of data, including procedures for when staff go on vacation.
- Install an alarm system and activate it at night.
- Keep the last two backup copies off site at all times.
- Burn a new CD daily and keep them off site. This will cost you 50¢/day.
- Hire an outside backup service to record your data off site daily.
- Use a heavy fireproof vault as an alternative to taking the backup tapes off site.
- Use twin hard drives. A second hard drive may minimize the risk of losing data if the first hard drive crashes, but it is of little use in protecting against fire and theft.
- Use a zip drive for quicker backups. An off-site copy is still required, though.
- Along with alarms, install iron bars on windows, if you have a storefront location, to discourage theft.
- Keep the backup medium away from the computer and out of sight.
- Replace the backup tapes periodically as they do wear out.
