← Resources · Reviewed 2026-09-28
Who is responsible for a medical practice’s EMR backup?
Short answer: it depends on your contract, and it must be written down. Many Ontario clinics assume a cloud or ASP EMR means “the vendor has backup covered.” Hosting availability and your ability to recover charts on a clinical timeline are different obligations.
What to get in writing
- What data is backed up (EMR, scanned documents, email, shared files)
- How often copies are taken and whether one copy is protected from ransomware
- Who initiates restore, how you request it, and the recovery time objective
- Whether a restore has been tested in the last 12 months, with a recorded result
Product demonstration
In the free CyberHealth check
We ask whether backup responsibility is documented and whether a real restore was tested. Unsure answers are scored as needing verification, not as safe.
Check restore readinessSources to review with counsel or your privacy lead: your EMR master services agreement, MSP statement of work, and IPC guidance on safeguarding personal health information.