A laboratory operates by keeping records. Each time you provide a customer with a written report; there are many pieces of information that have been recorded. These include patient identification, the sample number, the validation of results, the signatures of those who performed the testing, the quality control records, and the billing entry. In addition to losing files when a computer crashes or water gets into your server room during a heavy rainstorm, there are several other consequences that could result in serious problems. First of all, if a file has been lost, you cannot simply print out another copy of that report.
Secondly, it is possible that you will need to re-test the sample to obtain new results. Lastly, if you lose your files, it will be much harder to pass an audit. Lab data backup can turn a terrible day into something that doesn't put your business in jeopardy. This article provides instructions for how to create lab data backup for labs of all sizes. For larger labs that process hundreds of samples per day, even if they only lose a small amount of data (i.e. a few hours worth) it can cause confusion among their patients and require them to collect additional samples.
What Is Laboratory Data Backup?
Laboratory data backup refers to the process of copying all the lab's information off-site (off-site) in order to provide a method for restoring the data if the primary source is lost, damaged, or corrupted. Good pathology laboratory data backup would include the backup of the database, report files, image files, settings files, and user account files. It is important to note that the regularity of the backup processes is important; however, it is also important that someone has verified that the backup processes can be used to restore the data.
Laboratory Disaster Recovery: How It Differs from Backup
The backup is the duplicate. Disaster recovery for a laboratory means that you have a plan to get your lab back on-line if there is some major incident (fire, ransom ware, power outage for an extended period of time, etc.) that causes a problem with the lab. One of those parts is the backup. Recovery also includes who gets to decide what, how patients are cared for during this time and what systems will come back online first.
There are two terms used in this area. Recovery Point Objective (RPO) is a measure of the maximum amount of data loss that would be acceptable to the organization, i.e., whether the organization could tolerate the loss of the last hour of data, or if it must not allow any loss of data. Recovery Time Objective (RTO) is a measure of the maximum length of time an organization may take to resume business operations after a disaster. Both of these objectives will determine how often an organization backs up its data, and what type of disaster recovery solutions the organization invests in.
Common Reasons Diagnostic Laboratories Lose Data
Most data loss is mundane and not sensational. For example, a single receiving computer may have its hard drive fail. A power outage or a voltage surge will damage a computer system if there is no uninterruptible power supply (UPS) present. Employees can accidentally delete files. Ransomware can be delivered via an email attachment or an infected thumb drive. A small collection center can be damaged or vandalized. Software updates can cause problems. In addition, many laboratories create backup plans, but do not verify whether they work; therefore, when the data is required, the problem becomes evident. Since voltage fluctuations are very common in most communities, surge protection is just as important as software.
What Types of Laboratory Data Should Be Protected?
The first step should be to list out all items that you cannot afford to lose: patient demographics & visit history; test orders & results; test orders & signed reports; analyzer data & interface settings; QC, calibration & maintenance logs; billing & referral records; test master lists & report templates; staff accounts & audit trail logs; reagent stock records & SOPs. Note that some items will be more urgent than others. For example, patient records and reports are likely to be returned sooner than older archives. Additionally, retention periods vary depending on accreditation body requirements and state/federal laws regarding medical record retention. Therefore, you should consult with an expert in these areas rather than assume.
Methods of Laboratory Data Backup
Local backup
The use of a backup copy located on an external hard drive or another computer in your lab can provide you with rapid restoration capabilities; however, both options present the same potential threats to your data as those associated with the original computer (i.e., fire, floods, and theft). It is recommended that you store the backup drive in a location other than where the server is installed.
Offsite and cloud backup
The copies being stored in another place (or through a cloud service provider) will still exist if there is a disaster locally; however, they are dependent upon how fast the user has access to the internet, and also depend on the users' ability to correctly configure the access controls and encryption.
Manual versus automatic backup
The success of manual backup depends on human memory. Automated scheduled backups can be much more reliable, particularly when they notify you that an automated run has failed.
Full and incremental backups
A complete backup saves all of your data. On the other hand, an incremental backup will only save the data that has been modified from your last backup, saving you both time and space. The "3-2-1" rule is a popular method used for backing up data: make three copies of your data, store those copies on two separate forms of storage media, and keep at least one copy in an off-site location.
How to Create a Practical Disaster Recovery Plan
Keep the plan simple, in writing, and accessible to all team members. To start, make a list of critical systems, then prioritize them. Next, determine how long your laboratory can be without its critical systems before causing too much disruption (i.e., how many hours/days of downtime) as well as what amount of data loss is acceptable. Then, identify which member(s) will perform each role/responsibility within the plan, including designating a back-up individual. Prepare a manual process for recovering from a system failure: print out registration forms and sample collection forms, write labels by hand, record results on paper, and establish a procedure for entering these recorded results into the system once it is operational again.
Maintain a list of contact information for your software provider, your information technology department, your analyzer service engineer(s) and your internet service provider.Perform tests of restoring your systems from backups multiple times per year, as well as after significant updates have occurred to those systems. Review and revise the plan after every incident involving a failure of one of your systems.
The Role of Digital Laboratory Management Systems
The use of registries, spreadsheets, and various desktop files make it difficult to protect the information as no one knows where the data resides. When a lab uses laboratory management software that organizes all patient information, sample data, test results, reporting, and billing into one organized format, you will know exactly what requires protection and which individuals have access to the information. Lab management software using cloud technology may be able to lessen the reliance on a single computer, however, the manner in which backups are conducted will vary depending upon the vendor.
MargLabz is a lab operating system powered by artificial intelligence that can be used to run a diagnostic laboratory. The system has more than 40+ separate modules available to cover the different areas of running a lab including patient,sample management, test,report management, workflows, integration with analyzers, AI smart reports, and business operations. Regardless of which system you select, obtain written confirmation from your provider regarding how they backup your data, where it will be stored, how to restore it when needed and what will happen to your data once you terminate your service.
Diagnostic Lab Data Security and Access Control
Backups of sensitive health information must be treated in the same manner as live data. Each staff member should have their own unique username and password. Do not allow employees to share their login credentials. Limit employee access to those specific roles, for example, a receptionist does not require access to quality control (QC) settings. Utilize strong passwords and implement two-factor authentication (where applicable). Protect backups on laptops that leave the laboratory using encryption. Maintain an audit trail of which employee modified/deleted a record, and revoke an employee’s access the same day that they depart.
Ensure that all antivirus software and operating systems are kept up-to-date, and educate the laboratory team regarding the dangers associated with phishing emails and unauthorized USB flash drives. Do not report laboratory findings/results via open WhatsApp groups. Due to the sensitivity of health-related data, consult with a professional advisor regarding the relevant Indian data protection laws and laboratory accreditation standards.
Backup and Recovery Mistakes to Avoid
The single largest error is to fail to test your ability to restore from backup. Other common errors include: keeping only one copy of your backup on the same machine as your data; relying upon a single individual's knowledge of where and how backups are performed; failing to act upon notification of a failed backup; backing up report files rather than database files; allowing backup media to remain unencrypted; allowing only one person to know the password for access to your backups; failing to develop a plan to handle power or internet outage situations; and assuming that your vendor is responsible for all aspects of backup without confirming this with them.
Practical Recommendations for Diagnostic Laboratory Owners
Start this week. Identify your critical data, determine when the last successful backup took place, and test restore a single file. After identifying the critical data, create an offsite copy, install an Uninterruptible Power Supply (UPS) for the server and other essential computers, and develop a single-page disaster recovery plan that will be posted in the laboratory. Assign one person to verify backup status on a daily basis and review the recovery plan each quarter. If you have multiple collection centers, implement the same routine at each center; the weakest center will establish the level of protection provided to the organization.
Conclusion
Laboratory data backup isn’t an option. It is a necessity. Laboratory data protection saves lives (patients), provides reliable results (reports), ensures compliance (accreditation), and protects your reputation. Combine routine, tested backups with a straightforward disaster recovery plan, robust user access controls, and a thorough understanding of what your software provider will and won’t do for you. Small, consistent actions will benefit your diagnostic center much more than a flawless plan that nobody uses.