Backup for medical practices: GDPR requirements, patient data and how to protect yourself

Medical data is classed as "special-category data" under the GDPR — Art. 9(1)(h) — and enjoys the highest level of protection in the regulation. That means a medical practice's data security obligations are stricter than those of an ordinary business. A clinic or private practice without proper backup isn't just technically vulnerable: it's legally exposed, with the risk of significant fines and notification obligations in the event of an incident.

Many GPs, dentists and physiotherapy practices don't realise that the moment they store a patient record on a computer, they fall under the GDPR's most demanding regime.

What data a medical practice stores and why it's special

Every medical practice stores data that, by its nature, needs maximum protection:

• Medical records: diagnoses, medical history, medication, allergies
• Medical imaging: DICOM X-rays (dentistry, orthopaedics), ultrasounds, MRIs
• Psychological data: session notes, psychiatric diagnoses — a category with additional restrictions
• National health insurance data: if you have a contract with Romania's National Health Insurance House (CNAS), you transmit aggregated medical data electronically — it needs separate protection
• Billing data linked to treatment: the amount paid for a particular treatment can indirectly reveal a diagnosis

Under GDPR Art. 9, processing this data is allowed for medical purposes, but the security obligations (Art. 32) remain fully applicable and authorities interpret them more strictly for health data.

The concrete GDPR obligations a medical practice has for backup

GDPR Art. 32 — Security of processing requires "appropriate technical measures" to ensure the confidentiality, integrity and availability of data. For a medical practice, that means:

• Encrypted backup is mandatory: storing medical data unencrypted is a vulnerability that, in the event of an incident, automatically constitutes a security breach
• Availability and recoverability: Art. 5(1)(f) requires that data can be restored after a technical incident — if you have no backup and the hard drive fails, you're non-compliant
• Regular testing: Art. 32(1)(d) requires regular evaluation of the effectiveness of technical measures — an untested backup doesn't meet this requirement
• Retention in line with medical law: in Romania, Law 46/2003 and Ministry of Health Order 1101/2016 require medical records to be kept for 10 years after the last consultation — backups must respect this period

GDPR Art. 33 — Notifying the authority: in the event of a security breach involving medical data, you have 72 hours to notify the data protection authority.

A DPA (Data Processing Agreement) must be signed with any cloud provider where you store medical data — including your cloud backup provider.

The specific risks medical practices face

Medical practices are valuable targets for attackers precisely because their data is valuable:

• Ransomware locking patient records: the practice is completely paralysed — consultations become impossible without access to medical histories. A situation with a direct impact on patients' health.
• Medical data exfiltration: medical data sells on the dark web for far more than payment card data. An attack with exfiltration requires notifying the authority and every patient affected.
• Hardware failure with old records: a hard drive holding 5 years of records that fails permanently means losing the medical history of every patient — impossible to recover without a backup.
• A stolen laptop with records: if the laptop isn't encrypted, patients' medical data is compromised — an automatic breach that must be notified to the authority and to patients.
• Fire or flood at the practice: all local equipment destroyed, including the local backup if it's kept in the same space.

What doesn't work as medical backup

Improvised solutions are dangerous precisely because they give a false sense of security:

• A folder synced to OneDrive or Google Drive: ransomware encrypts the synced folder too — within hours, the cloud copy becomes unusable. And medical data in the cloud without a DPA with the provider = GDPR non-compliance.
• An external USB drive permanently connected to the computer: encrypted by ransomware along with the rest of the system, or physically destroyed or stolen with the computer.
• Unencrypted backup: if someone accesses the backup, patients' medical data is completely exposed — an automatic breach.
• The medical software's database (Hipocrate, etc.) with no external backup: if the server running the application is destroyed or attacked, the whole database disappears.

The right solution for medical practices

The implementation we recommend and configure for medical practices has four components:

1. A local Synology NAS with immutable snapshots every 4–8h: immutable snapshots can't be modified or deleted by ransomware. An RPO of 4–8h — acceptable for most practices; configurable to 1–2h for large volumes.
2. AES-256 encrypted offsite backup on Wasabi (eu-central-1): data outside the local network — full protection against fire, flood or theft. End-to-end encryption: the key stays with you, and not even Wasabi can read patient records.
3. Retention configured in line with Law 46/2003: medical records are kept for 10 years after the last consultation — the backup policy meets this requirement automatically.
4. Complete documentation for a GDPR audit: the backup procedure, quarterly restore reports, a signed DPA — everything the authority checks during an audit.

Estimated cost and why it's worth it

The cost of a complete backup system for a medical practice with 1–3 computers:

• Synology DS223 NAS (2 bays): ~€600–800, one-off
• 2 × Seagate IronWolf 4TB drives (RAID 1): ~€250–300, one-off
• Wasabi cloud storage, 500GB (text records + X-rays): ~€3.50/month
• BackupFirma service (setup + monitoring + DPA): included in the Business or Professional packages

Total initial investment: ~€900–1,100. Monthly cost: under €5.

Compared with the minimum GDPR fine for a medical practice that can't demonstrate appropriate technical measures after an incident: €5,000–50,000. The maths is simple.