This article explains, in plain English, what to back up, the standards worth following, and how to make sure that when you need to recover, you actually can.
Backup planning starts with knowing what matters. For a care provider, the critical data usually spans several systems.
A common blind spot is assuming the care management platform vendor backs everything up, while forgetting email, shared files and finance systems entirely. A complete plan accounts for every system that would hurt if it disappeared.
The most durable and widely recommended standard for backup is the 3-2-1 rule. It is deliberately simple: keep three copies of your data, on two different types of media, with at least one copy stored off-site. The point is to eliminate any single point of failure. If your only backup sits on a drive next to the server, a fire, flood, theft or ransomware attack can take both at once. Spreading copies across media and locations means no single event can destroy them all.
Backups are one of the ACSC Essential Eight controls. Take our free Essential Eight Assessment to see how your current backup and recovery practices measure up against the standard.
Two terms sit at the heart of recovery planning, and both are simpler than they sound.
Recovery Point Objective (RPO) is how much data you can afford to lose, measured in time. If your systems are backed up once a day, your RPO is up to 24 hours, a failure could cost you a day's records. If you back up hourly, you lose at most an hour. For clinical documentation, a long RPO can mean re-creating notes from memory, so the acceptable figure is usually short.
Recovery Time Objective (RTO) is how quickly you need to be back up and running after an outage. A finance system might tolerate a day; a system your staff need to safely deliver and document care may need to be back in an hour or two. Setting a clear RPO and RTO for each critical system is what turns backup from a vague reassurance into a design you can actually build and measure against.
Many providers assume that because their data lives in Microsoft 365 or another cloud service, it is automatically safe. This is a dangerous misunderstanding. Cloud platforms operate on a shared responsibility model: the provider keeps the platform running and available, but your data, and protecting it from your own mistakes, remains your responsibility. Microsoft, for instance, is explicit that customers should use a third-party backup for their data.
Native retention is often short and easy to bypass. If a staff member is compromised by phishing and an attacker deletes mailboxes and files, or if data is quietly corrupted and the problem is not noticed for weeks, native recycle bins and retention windows may not save you. A dedicated, independent backup of your cloud services is a separate protective layer, and for care providers holding health information, it is not optional.
Ransomware has changed what a good backup has to withstand. Attackers know that backups are their enemy, so modern ransomware actively hunts for and encrypts or deletes any backups it can reach before triggering the attack. If your backup is online and accessible with the same administrator credentials as everything else, it can be destroyed along with your live data.
The answer is immutable backups, copies that cannot be modified or deleted for a defined retention period, even by an administrator account. Combined with keeping at least one copy off-site and logically separated from the production network, immutability means that even in the worst case, a clean copy survives to recover from. This is precisely what turns a ransomware incident from a business-ending event into a recovery exercise measured in hours.
Backups fail silently for all sorts of reasons: a job that stopped running months ago, a system that was never added to the schedule, or files that restore corrupted. The only way to know is to test regularly, verify recovered data is usable, and document the results.
Backup is one part of a bigger question: how do you keep delivering care when systems are down? A business continuity plan connects your backups to the practical reality of a shift. It should answer how staff document care and administer medication if the primary system is unavailable, who is contacted and in what order, how long a fallback is workable, and how you return to normal once systems are restored. For care providers this planning aligns with the expectation under the NDIS Practice Standards and aged care obligations that you can continue to deliver supports safely and manage information responsibly, even when things go wrong.
Backup is not only about surviving a disaster; it also intersects with how long you are required to keep records. Care providers are subject to record-retention obligations that can extend for years, and in some cases well beyond the period a client is with you. Client health records, incident documentation and financial records each carry their own minimum retention expectations under the relevant standards and legislation. Your backup and archiving approach should be designed with these in mind, so that you can produce records when required for an audit, a complaint or a regulatory request, while also ensuring that information is disposed of appropriately once it is no longer needed, in line with the Privacy Act 1988.
Backup is not a fringe concern; it is one of the eight mitigation strategies in the ACSC Essential Eight, listed as regular backups. The Essential Eight expects backups of important data, software and configuration to be performed and retained, and, crucially, restoration to be tested. Aligning your backup programme with this standard does double duty: it protects the organisation, and it demonstrates to funders, auditors and boards that you are managing cyber risk to a recognised Australian benchmark.
The 3-2-1 rule is a simple, widely recommended standard: keep at least three copies of your data, on two different types of media, with at least one copy stored off-site. It protects you against a single point of failure, so that a hardware fault, a site disaster or a ransomware attack cannot wipe out every copy at once.
Not entirely. Cloud platforms like Microsoft 365 protect their own infrastructure, but under the shared responsibility model your data is still your responsibility. Accidental deletion, a compromised account or ransomware can destroy cloud data, and native retention is often short. A dedicated backup of your cloud services is a separate and necessary layer.
RPO, or Recovery Point Objective, is how much data you can afford to lose, measured in time, for example, backing up hourly means losing at most an hour of records. RTO, or Recovery Time Objective, is how quickly you need systems back after an outage. Setting both for your clinical and operational systems drives how you design backup and recovery.
Modern ransomware deliberately seeks out and encrypts or deletes backups so victims are forced to pay. Immutable backups cannot be altered or deleted for a set period, even by an administrator account, so a copy survives the attack and you can restore. This is what turns a ransomware incident from a catastrophe into a recovery.
Backup and disaster recovery is exactly the kind of thing worth verifying rather than assuming. CareIQ IT designs and manages backup for NDIS and aged care organisations against the 3-2-1 rule and the ACSC Essential Eight: dedicated backup of Microsoft 365 and cloud services, immutable copies that survive a ransomware attack, defined RPO and RTO for your critical systems, and scheduled restore testing with documented results. Our managed IT services also cover the business continuity side, so your team knows exactly how to keep delivering care if a primary system goes down.
Separately, if client records currently live across personal devices and shared drives rather than one access-controlled system, the CareIQ platform gives care organisations a secure, purpose-built home for that data, with its own backup and audit trail built in.
CareIQ IT designs backup and disaster recovery to the 3-2-1 rule and the Essential Eight, with immutable backups and tested restores, for NDIS and aged care organisations.
Talk to CareIQ ITGeneral information only, not cyber security or legal advice. Recheck current requirements and your specific technical environment, and seek qualified specialist advice before acting.