Business continuity and clinical-record backups: a 2026 guide for therapists

A lost laptop, compromised email account, software outage, or flood should not make clinical records disappear or abruptly stop client care. In a solo practice, though, a small technical event can quickly become a confidentiality, record-keeping, and service-continuity problem.

A business continuity plan is not a heavyweight document for large hospitals. It is a short, usable procedure that answers four questions: which information must remain available, where safe backup copies live, who does what during an incident, and how clients can be contacted without disclosing more personal information.

This guide is for psychologists, social workers, psychotherapists, counsellors, therapists, and coaches in private practice. It is operational guidance, not legal advice or a substitute for a regulator's standards.

Why clinical records need a specific plan

A client record often combines contact details, appointments, invoices, consent forms, and progress notes. Together, those items can reveal that a person is receiving care as well as sensitive health information. The Office of the Privacy Commissioner of Canada says safeguards should be appropriate to the sensitivity of the information. Quebec's privacy framework similarly calls for reasonable safeguards that take account of factors including sensitivity and quantity.

Availability matters alongside confidentiality. When a calendar is unavailable on a busy clinical day, appointments may be missed and urgent needs may not be identified. If notes are lost or altered, continuity of care and record-keeping obligations are affected.

A useful plan therefore protects three outcomes:

Confidentiality: only authorized people can access information.
Integrity: records remain accurate, complete, and recoverable.
Availability: the information needed to provide services returns quickly enough and safely enough.

Plan for likely incidents, not every imaginable disaster

Start with the scenarios a small practice can realistically face. Five or six are usually enough.

Incident	Potential effect	Prepared response
Lost, stolen, or damaged device	local records and email unavailable	encryption, backup copy, replacement procedure
Phishing or compromised password	unauthorized account access	reset, session revocation, breach assessment
Internet or platform outage	calendar and forms unavailable	minimal offline schedule, alternate contact channel
Accidental deletion	missing record or document	tested restore, incident log
Office damage	paper and equipment lost	off-site copies, emergency contacts, secure remote access

Canada's Centre for Cyber Security advises organizations to prepare and test backups. That second verb matters: a backup that has never been restored is an assumption, not a recovery capability.

Build backups that can actually restore the practice

The “3-2-1” rule is a useful starting point: keep at least three copies of data, on two different media types, with one copy off site. A clinical practice still needs to apply it thoughtfully.

1. Identify what needs protection

Do not stop at progress notes. Inventory what is needed to resume work: client files and attachments, calendar data, invoices and receipts, consent forms, document templates, professional contacts, platform settings, and internal procedures. Record where each item lives: practice-management software, email, encrypted drive, cloud storage, or paper file.

2. Use separate, encrypted copies

A synchronized folder is not automatically a backup. Deletion or ransomware encryption can synchronize too. Where available, use version history or immutable backup copies. For exported records, encrypt the storage device and keep its recovery key or password separately.

Avoid emailing client files to a personal account or keeping them on an unencrypted USB drive. Canadian government guidance recommends encryption for sensitive information stored or transmitted electronically. Ask each provider where data and backups are hosted, who can access them, how backups are protected, and how export and deletion work.

3. Set frequency based on risk

For an active calendar and daily notes, an annual export is plainly not enough. A practice may choose automated daily backups with a weekly check, then adjust according to its volume and the protections already provided by its platform. The key is to document the decision: what is copied, how often, by which method, and who checks a failed-backup alert.

4. Test recovery

At least quarterly, restore a small sample into a safe location: a document, a form, and a calendar extract. Confirm that they are readable, complete, and correctly permissioned. Log the date, result, and any correction. This makes the answer concrete if a client, insurer, or regulator asks how records are protected.

A one-page continuity plan

Your plan can fit on one page if it is actionable. Keep a copy accessible away from the main computer, but never put passwords or clinical information in it.

Trigger: define an incident—lost device, suspicious access, prolonged outage, deleted record, or misdirected message.
Stabilize: disconnect the affected device or account if appropriate, without deleting material that may help establish what occurred.
Continue services: use a pre-agreed backup channel, confirm appointments without putting clinical detail in messages, and prioritize clients with urgent needs.
Restore: use the validated backup and record what was restored and what remains unavailable.
Assess and document: record timing, systems affected, actions taken, notifications, and improvements.

For a small clinic, name a privacy lead and a backup person. In a solo practice, designate a trusted contact who knows where emergency instructions are kept, without giving them day-to-day access to records.

When the software is down: preserve a safe communication path

Printing every client's details creates its own privacy risk. Instead, keep only the minimum necessary for the day in a separately protected location: for example, an encrypted schedule with name, contact method, and appointment time. Do not include diagnosis, notes, or reason for consultation.

Prepare two neutral messages in advance. One can confirm or reschedule: “A technical issue is temporarily affecting our appointment system. Please reply to this message or use the agreed phone number to confirm your appointment.” The other can advise of a delay. Any fallback channel should respect the client's communication consent and avoid sensitive health details.

Telepractice needs its own variant: identify an approved alternate link or telephone number, how identity will be confirmed, and when a session should be rescheduled because confidentiality cannot be maintained.

A privacy breach needs its own response

An outage is not automatically a privacy breach. A lost device, wrong recipient, or compromised account may be. In Quebec, organizations must keep a register of confidentiality incidents and, if an incident presents a risk of serious injury, notify the Commission d'accès à l'information and affected individuals promptly. Under PIPEDA, subject organizations must keep records of breaches and report breaches involving a real risk of significant harm to the OPC and affected individuals.

Your plan should include a concise assessment form: what information was involved, was it encrypted, who could have accessed it, has access been contained, and what reduces the risk? Do not assure clients that there was “no risk” until the facts are established. Consult your insurer, regulator, or legal adviser when the situation warrants it.

Mistakes that defeat the plan

Keeping the only backup on the same computer as the records.
Sharing one platform account among colleagues or assistants.
Relying on a password alone instead of enabling multi-factor authentication.
Storing passwords in the continuity plan or an unprotected spreadsheet.
Never testing recovery or updating contact details.
Posting detailed outage notices on social media.

A 20-minute annual checklist

Inventory of records, calendar, invoices, consents, and templates is current.
Backup location, encryption, and retention are verified.
A test restoration is documented.
Multi-factor authentication is active for email, platform, and storage.
Work devices are encrypted, locked, and updated.
Continuity messages and support contacts are ready.
Incident procedure, register, and reporting duties are reviewed.
Access is removed for former staff, trainees, and vendors.

Practice-management software can reduce manual work by bringing calendars, records, forms, and receipts together. It does not remove the professional's responsibility to check safeguards, limit access, and know how care will continue through an incident. FYL.care helps create that administrative foundation without another subscription. Free. No credit card. Forever.

Primary sources

FAQ

How often should a therapist back up clinical records?

It depends on data volume and protections already offered by the platform. For a practice adding appointments and notes every day, automated daily copies, regular monitoring, and tested restoration are a reasonable baseline.

Does cloud synchronization count as a backup?

Not necessarily. Synchronization can replicate deletion or malicious encryption. Check for separate copies, version history, and a tested restoration process.

Do all clients need to be notified after an outage?

No, not if no personal information was exposed. If the event is a privacy breach, assess applicable recordkeeping, reporting, and notification obligations. Quebec and PIPEDA impose duties for certain incidents based on the risk involved.

Can I keep a paper emergency appointment list?

Yes, if it contains only the minimum information, is protected from unauthorized access, and is updated or destroyed according to a documented process. Do not include notes, diagnoses, or reasons for care.