Immutable Backups, Ransomware, and Insurance Evidence for Practices
Why cyber insurers ask for immutable or offline backups and a dated restore test. A practical evidence checklist for medical and dental practices.
Cyber insurance renewals for healthcare practices increasingly ask for proof, not promises. One of the most common proof points is backups: not only that backups exist, but that at least one copy is offline or immutable, and that you can name the date of the last restore test.
This post is for practice admins and owners (roughly 5 to 100 staff). It is not fear-mongering. It is a practical evidence checklist you can run with your office manager and IT provider 60 to 90 days before renewal.
Harborline prepares evidence packs as part of flat-fee work. A typical single-site HIPAA / 360 Risk Assessment is a fixed fee, scoped on a short call. The Annual Security Program is available if you want the pack kept current. We work alongside your broker. We do not replace them, and we do not promise a specific premium.
Why carriers care about backup design
Ransomware and destructive incidents often try to encrypt or delete the backups you would use to recover. If every copy sits on the same reachable network identity, we have backups can fail when you need it most.
Insurers ask questions that force a clearer answer:
- 1Do you have backups?
- 2Is at least one copy offline, air-gapped, or immutable (cannot be altered for a retention window)?
- 3When did you last restore something and document it?
- 4Who owns recovery if systems are down for a day?
Honest answers with documents behind them beat clever wording.
What immutable means in practice language
You do not need a data-center vocabulary quiz. In practice terms, immutable or offline usually means one of these patterns (your MSP will name the product):
- 1Object-lock or write-once retention on a cloud backup repository for a set number of days
- 2An offline or disconnected copy that is not continuously reachable with the same admin credentials as production
- 3A vendor-managed immutable tier with retention you can show in a portal screenshot (no PHI in the screenshot)
Ask your IT provider: if ransomware had our normal admin credentials, could it delete or encrypt every backup copy? If the answer is unclear, treat the item as open before renewal.
Evidence checklist (backups and recovery)
Use this as a pre-renewal pass. If you cannot point to proof, mark it open.
- 1Backup product and scope named (what systems, including EHR-adjacent data paths)
- 2Offline or immutable copy described in one sentence your broker can understand
- 3Last restore test date (ideally within 90 days) with who ran it
- 4What was restored (even a non-PHI file or a test volume counts if documented)
- 5Written RTO and RPO leadership actually agreed to (short is fine)
- 6Call tree for a day-long outage (admin, IT or MSP, owner, counsel or insurer contacts as appropriate)
- 7Open gaps with owners and due dates if something is not done yet
This list pairs with the Harborline renewal readiness checklist, and with MFA, EDR, training, and risk analysis evidence carriers also request.
How this connects to HIPAA (without overclaiming)
The Security Rule expects contingency planning and protections for ePHI availability. A dated restore test and a recoverable backup design support that expectation. They are not a substitute for a full security risk analysis. They are part of the evidence picture.
If your risk analysis is stale, fix that too. Carriers and OCR requests often ask for a current analysis alongside control proof.
How Harborline helps, and what we will not promise
- 1Verify before you attest. We check the controls the application asks about so every yes matches evidence you can produce.
- 2Drive agreed gaps with your IT team or MSP. They keep running the technology. We prioritize and verify evidence as items land.
- 3Keep it current on the Annual Security Program calendar so next year's renewal starts with answers in hand.
We will not promise:
- 1A specific premium reduction
- 2That we sign the insurance application for you
- 3That every carrier will quote the same way
Timing and price
Every Harborline service is a fixed fee, quoted in writing after a short scoping call. That covers the typical single-site assessment, extra remote or on-site locations (on-site visits add travel at cost), the Physical Security Walkthrough add-on, and the Annual Security Program. A typical single-site remote assessment often takes 2 to 4 weeks.
If your renewal date is inside the assessment window, say so on the scoping call. We will tell you honestly what fits.
Book a 30-minute scoping call
Bring the application or broker questions if you have them. No SOW until fit is clear.
Harborline · Contact · harborlinesec.com
Further reading
HIPAA Security Rule: What Good Looks Like for Practices with 5 to 100 Staff
A practical picture of HIPAA Security Rule readiness for outpatient practices. Administrative, physical, and technical safeguards without enterprise theater.
MFA Hardening for Practices: Google Workspace and Microsoft 365
Short MFA hardening checklists for Google Workspace and Microsoft 365 in medical and dental practices. Evidence carriers ask for, without enterprise theater.
HIPAA Security Risk Analysis: What Practices Get Wrong
The most common HIPAA security risk analysis mistakes for practices with 5 to 100 staff, and how to fix them without a free assessment or a checkbox PDF.
Ready to talk?
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.