Anish Pandey · 2026-02-08 · 8 min read
MediCare Clinic is a 12-doctor multi-speciality outpatient clinic in Pune's Kothrud area with approximately 180 patient consultations per day. Their practice management software — appointment scheduling, patient records, billing, and pharmacy — runs on a Windows Server 2019 machine in the server room at the back of the clinic. On a Thursday morning in November 2025, the clinic administrator arrived to find the server had not restarted after a planned power cut the previous night. The hard drive had failed. The most recent backup was a USB drive in the server room — which contained data from three months ago. This is the story of what happened next, and how they rebuilt their backup architecture so it can never happen again.
At 8:15 AM on a Thursday, MediCare's receptionist called the clinic's IT support number. The server would not boot. By 9 AM, it was clear the hard drive had failed — a mechanical failure with no warning indicators in the event logs. The IT vendor attempted data recovery but determined the drive required professional forensic recovery, which would take 10 to 14 business days and cost ₹45,000 to ₹1.2 lakh depending on the extent of recovery. The clinic had 180 appointments booked for that day. With no access to patient records or the billing system, they had three choices: cancel all appointments, run on paper and manually rebuild records later, or find another way. The only backup was a 3-month-old USB drive. The patient records and billing data from August to November — approximately 16,000 consultations — was potentially gone.
A proper backup architecture for a clinic of MediCare's size follows the 3-2-1 rule: three copies of the data, on two different media types, with one copy off-site. The USB drive in the server room violated all three principles — it was one copy, on the same media type as the server, in the same physical location. A cloud backup agent running on the server would have taken an incremental backup every 4 hours (capturing any changes since the last backup) and sent it encrypted to an AWS S3 bucket or Azure Blob Storage. The incremental backup of a clinic's daily data change is typically 200 to 500 MB — fast to upload on any business internet connection and costing approximately ₹400 to ₹800 per month in cloud storage.
Fortunately, our team had been working with MediCare for three months on a cloud backup implementation that was 80% complete. The cloud backup agent had been installed in September and was backing up to AWS S3 — the most recent backup was from the previous evening at 11 PM. When the server failed, our team's team was notified automatically by the monitoring agent (which sends an alert if no backup completes within 6 hours). The restoration process: a replacement server (a spare unit kept by our team for emergency deployments) was driven to the clinic. The Windows Server OS was installed in 45 minutes from an image. The practice management application was reinstalled in 20 minutes. The data was restored from the AWS S3 backup in 31 minutes. Total time from call to operational: 2 hours 14 minutes. Data lost: 9 hours (the 11 PM to 8 AM gap), which the receptionist manually updated from the morning's paper log.
India's Digital Information Security in Healthcare Act (DISHA), when enacted, will require healthcare providers to maintain patient health data with specific security and backup controls. Even before DISHA's enactment, NABH accreditation standards (which many multi-speciality clinics pursue for insurance empanelment) require documented backup and data recovery procedures with evidence of regular testing. MediCare's USB backup strategy would not pass a NABH audit. The cloud backup implementation — with automated backups every 4 hours, 90-day retention, encryption at rest and in transit, and a documented restoration procedure that was tested and proven — meets both NABH and anticipated DISHA requirements. For clinics seeking NABH accreditation or empanelment with major health insurance providers, the backup documentation is a required deliverable.
MediCare's full backup architecture post-incident includes three components. First, the cloud backup agent (Veeam on the server, backing up to AWS S3 with 90-day retention and daily backup testing). Second, a local NAS device (a Network Attached Storage unit with RAID-1 mirroring) that provides the local backup copy for fast restoration without downloading from the cloud — the NAS restoration takes 18 minutes versus 31 minutes from AWS, useful for non-critical restores. Third, an automated weekly restore test — every Sunday at 3 AM, the backup agent performs a test restoration to a sandboxed environment and sends a report confirming the backup is healthy and restorable. The total monthly cost for this architecture: ₹8,400 (cloud storage + backup agent licence + monitoring).
MediCare's near-catastrophe is not unique to healthcare. Any business that stores data on a local server — a law firm, a CA practice, a manufacturing company's ERP data, a school's student records — faces the same risk. The hard drive failure is the most common single point of failure, but ransomware, fire, flooding, and theft create the same outcome: data that was not backed up off-site is gone. The cost of a cloud backup implementation for most small businesses is ₹4,000 to ₹12,000 per month depending on data volume. The cost of a data recovery engagement without a backup ranges from ₹45,000 to several lakh. our team implements cloud backup using Veeam, Acronis, and AWS native backup tools, with monitoring, testing, and disaster recovery planning included.
MediCare Clinic's story had a good ending because their cloud backup was 80% deployed. Had the hard drive failed 6 weeks earlier, before the backup agent was installed, 16,000 patient records would have been unrecoverable. Every clinic, every law firm, every accounting practice, and every manufacturing company that stores data on a local server should answer one question: if that server died tonight, how much data would you lose and how long would it take to recover? If the answer is more than 24 hours of data or more than 4 hours of recovery time, the backup architecture needs to be fixed. We can do that assessment in one conversation.
Topics: Cloud Backup, Data Recovery, Healthcare IT, DISHA, Business Continuity, Pune, India