An IT Disaster Recovery Blueprint for Healthcare Organizations

Municipalities are often targets for ransomware and other cyberattacks. Ransomware attacks get a lot of attention, but there are other cyberattacks that can also be devastating. 

• Distributed Denial of Service (DDoS) Attacks: DDoS attacks overwhelm a municipality’s servers with traffic, causing service disruptions and potentially taking down websites and online services. 
• Business Email Compromise (BEC): BEC attacks involve fraudsters impersonating executives or trusted partners to trick employees into transferring funds or sharing sensitive information. 
• Malware: Malware includes various types of malicious software such as viruses, worms, and trojans designed to damage, disrupt, or gain unauthorized access to systems.

🔎 Related: Reality of Ransomware

Tornadoes 

In the United States, tornado season lasts from approximately March through July, although a tornado can strike at any time. The South usually gets the most tornadoes between March and May, while the Northern Plains and Midwest are most at risk during June and July. 

Remember, all it takes is an “average” tornado such as an F2 tornado, with winds upward of 150 miles per hour, to cause serious damage. 

Hurricanes 

Hurricane season lasts from approximately June through November, although a hurricane sometimes appears outside of that monthly range. States that most need to worry are the Gulf Coast states (Texas, Louisiana, Mississippi, Alabama) and East Coast states (especially Florida, Georgia, South Carolina, North Carolina, Virginia, and New York). 

Even “mild” hurricanes can cause enormous flooding, power outages, and wind damage, from the coast to far inland. 

Wildfires

Wildfire season lasts from approximately October through January, although wildfires can spread any time. While California gets most of the media attention for its massive wildfires, Texas actually experiences the most. The Southeast is also quite prone to wildfires. 

There is often little warning before a wildfire tears through an area, giving people evacuation as an only option. The devastation to an organization can be apocalyptic. 

Earthquakes

Thankfully, massive earthquakes are rare, but they can happen out of nowhere. Again, California is an obvious state at higher risk, but states such as Alaska and Hawaii also experience many earthquakes. Earthquakes can quickly destroy buildings—which contain your servers and IT equipment—and lead to permanent data loss and operational disruption along with loss of life. 

Use onsite local data backups to lessen  time to recovery for smaller incidents (such as a server failure). 

An onsite backup solution can get you up and running again in minutes, which is crucial for minimizing downtime that can interfere with patient care. Local backups do not rely on an internet connection, ensuring data can be backed up and restored even during internet outages. IT staff can manage and maintain local backup systems directly, sometimes allowing for quicker troubleshooting and problem resolution. 

For example, you might have an older server that dies after a severe power outage as a result of a bad thunderstorm. The onsite backup will take over and operate as that server until your healthcare organization can order and replace the hardware. Because there is a power outage that also prevents your connection to the internet, you are able to run the local backup once your generator starts working, allowing you immediate access to your data so that you can continue caring for patients. 

Use offsite data backup to plan for worst-case scenarios. Offsite means storing your data backups far from your geographical location. 

Offsite does not mean another floor on your building, or at another site within your metro area. It means geographically distant in case of disasters that take out all your local equipment. Flooding, hurricanes, and tornadoes can easily destroy backup servers onsite, leaving you with permanent data loss. And ransomware can infect all equipment on your network, including your local backups. 

Storing backups offsite reduces the risk of losing all data due to a single catastrophic event affecting your primary location. By keeping backups in a different geographic location, you can mitigate risks associated with localized events, ensuring continuity of care. Plus, as long as you have an internet connection, you can remotely access your offsite data while restoration and repair takes place—allowing staff members to continue taking care of patients. 

Offsite backups are also less susceptible to ransomware and other malware attacks that can encrypt or delete on-premises data. Data can be stored redundantly across multiple locations or cloud regions, providing additional layers of protection and availability. Anytime/anywhere access makes cloud backups an especially good choice for healthcare organizations, given the dire need to stay operational so that you do not risk lapses in patient care. (Remember, cloud applications still need to be backed up – many healthcare organizations assume anything in the cloud is automatically backed up, but that’s not the case.) 

Monitor your data backups. It’s important to identify problems with your onsite and offsite backups before a disaster occurs. 

Data backup monitoring ensures the integrity, reliability, and availability of your healthcare data when needed, confirming that backups are completed successfully without errors. 

• Monitoring systems can send alerts in real-time if a backup fails or if there are issues. By detecting failures proactively, you can promptly troubleshoot and resolve problems before they lead to a significant disruption in patient care. 
• Monitoring includes regularly checking the integrity of the backed-up data to ensure it is complete and uncorrupted. This guarantees that the data can be reliably restored. Don’t assume you’re able to resume normal healthcare operations after an incident, only to find out critical medical records or patient information is unavailable. 
• Monitoring can help identify unusual activity that may reveal a ransomware attack or other security threats, allowing for immediate action. 

Ransomware is bad enough—but you don’t want your healthcare staff to increase that risk. Yet, many employees are tricked by clever cybercriminals who use sophisticated social engineering tactics by means of emails that contain malicious attachments or links to malicious websites. Healthcare employees can be particularly susceptible because they are stressed, harried, and overwhelmed—increasing the risk of clicking on a bad link or attachment. 

A cyberattacker’s strategy might involve posing as a trusted entity (such as a colleague, boss, or healthcare vendor) and convincing an employee to download a file or click a link. For example, an email might claim to be from IT support needing the employee to run a supposed update or security tool. Employees can also visit compromised or malicious websites that may trick them into providing their login credentials on fake login pages. 

Cybercriminals often use these credentials to access networks and systems, where they deploy ransomware manually. They can also gain access to email accounts or other systems, spreading ransomware within the organization by sending infected emails from a trusted source. 

Train employees to recognize phishing emails and understand the risks associated with opening attachments or clicking links from unknown sources.

🔎 Related: How Email Security Awareness Training Protects Against Phishing Scams

A comprehensive disaster recovery plan is essential for ensuring that your healthcare organization can quickly and effectively respond to and recover from unexpected disruptions. Your plan should identify potential threats (natural disasters, cyberattacks, hardware failures, human errors) and assess the potential impact of different disaster scenarios on critical healthcare functions and processes.