Questions to Ask Your Dental IT Company About Backups

Most dentists never ask their IT company about backups until something goes wrong. That is understandable: you hired them so you would not have to think about it. But the answers decide whether you recover in a day or lose records for good. Use the list below as a one-meeting review. Ask the questions as written, ask for the answers in writing, and file them with your other practice records.

You do not need to judge the technical detail. You are listening for four things: a specific answer, a date or name attached to it, willingness to put it in writing, and no defensiveness. If an answer is vague, say "please send me that in an email" and see what comes back.

How should I use this list?

Print it. Number the answers. Mark each one clear, vague or missing. Anything vague or missing becomes a follow-up item with a due date. If you are an office manager rather than the dentist, your dentist should still see the answers, because the decisions about the practice's records are theirs to make.

Group 1: Where do the copies of our data live?

1. How many copies of our patient data exist, and where is each one?

A good answer sounds like: "Three copies. One on your server, one on a device in the office, and one in a cloud storage service in a different location. Here is the list, and here is who runs each."

A single copy, or copies that all sit in your building, is the answer to worry about.

2. Is at least one copy stored with a different company and outside your building?

A good answer sounds like: "Yes. One copy is held by a separate storage provider, so a problem at your office or at one provider does not take everything." Ask them to name the provider.

Group 2: Can any copy be altered or deleted?

3. Is any backup protected so that it cannot be changed or deleted, even by someone with an administrator login, until a set date?

A good answer sounds like: "Yes. Recovery points are locked for a set period, and here is the period. Ransomware that reaches your network cannot encrypt them." Be wary of "we have strong passwords" as the whole answer.

4. If an attacker got hold of our IT company's own login, what could they do to our backups?

A good answer sounds like: "They could not delete the protected copies. We use multi-factor sign-in and separate admin accounts, and here is how we get alerted if retention settings change."

Group 3: How do you know a restore will work?

5. When did you last restore real data from our backup, and what did you restore?

A good answer sounds like: "On this date we restored a patient chart and a set of images to a test location, opened them, and recorded the result. Here is the record." If the answer is "never", that is your answer.

6. How long would a full restore take, and what is that estimate based on?

A good answer sounds like: "Our estimate is based on a restore we ran for your practice, and here is what could make it slower." Watch for a confident number with no test behind it.

Group 4: Who can delete our backups?

7. Who has the ability to delete or shorten the retention of our backups, and how is that controlled?

A good answer sounds like: "Two named people on our team, each with multi-factor sign-in. Changes are logged, and you are notified." You should also be told whether anyone in your own office has that power.

8. When someone leaves your company, or leaves our practice, how fast is their access removed?

A good answer sounds like: "Same day, and we keep a record. We review the access list every quarter."

Group 5: Is there a Business Associate Agreement?

9. Will your company and the backup storage provider both sign a Business Associate Agreement with us, and can we see it?

A good answer sounds like: "Yes. Here is the agreement, here are the subcontractors who may touch your data, and here is how we notify you of an incident." If you want the background, read whether your backup provider needs a BAA. The agreement itself is a legal document, so have your own lawyer review it.

Group 6: Who owns the data and can we reach it?

10. Is it written in our contract that the data belongs to the practice?

A good answer sounds like: "Yes, clause so-and-so says so." Our page on who owns your dental backup data explains what to look for.

11. Can we have our own login or a documented way to get a copy of our backups, without needing your permission?

A good answer sounds like: "Yes. You have a read-only login, or you can request a full copy and we deliver it within an agreed number of days, in a format your software can use."

Group 7: What happens if we change IT provider?

12. If we leave, what do you hand over, in what form, by when, and at what cost?

A good answer sounds like: "A full copy of your data and a list of accounts and settings, within an agreed time. The fee, if any, is in the contract."

13. Will you cooperate with the new provider and help confirm the data is complete?

A good answer sounds like: "Yes. We run a handover with them, you sign off once a test restore succeeds, and only then do we remove our access."

14. When we leave, how is our data deleted from your systems, and will you confirm it in writing?

A good answer sounds like: "After the handover is signed off, we delete it within an agreed period and send a written confirmation."

What if the answers are vague?

Do not panic and do not fire anyone on the spot. Write down which questions came back vague or missing, set a date for the written answers, and, if the gaps matter, ask a second provider to review your setup. A backup you cannot describe is a backup you cannot rely on. If you want a yardstick, our guide to what to look for in dental cloud backup compares what the main options should offer, and how managed backup works for practices shows what we provide.

How would DDSArk answer?

On the groups where we hold registered statements, this is how DDSArk answers:

• Signs a HIPAA Business Associate Agreement
• Immutable recovery points
• Replicated to a second, independent provider (Wasabi)

On restore testing, ownership and access, and leaving us, read the contract and ask us the same questions in writing. That is the standard we suggest you hold every provider to.

This page is educational and is not legal advice.