If your PACS is your only copy, you do not have a backup
I have seen this go badly more than once. A small imaging practice runs a single PACS server in a back room with RAID 5 and a USB drive someone takes home on Fridays. The AC unit fails over a long weekend, the array degrades, the rebuild fails, and a few hundred thousand prior studies become an open question. The Friday USB? Last successful copy was nine weeks ago, because nobody was checking the logs.
DICOM backup is not glamorous, and the standards-compliant path is not complicated. But the consequences of doing it badly are severe: HIPAA penalties, OCR investigations, and the clinical problem of not being able to compare a current study to a prior one.
The numbers that drive the design
A typical mixed-modality outpatient practice produces somewhere between 2 and 20 GB per day of new DICOM data, depending on whether you do CT and MR or stay mostly in ultrasound and plain film. CT studies run 50 to 500 MB. MR studies, 30 to 250 MB. A digital mammo screening with priors can push past 1 GB. Tomosynthesis is worse. None of this compresses well after the modality has already done its lossless work, so plan capacity off raw counts.
For a 5-physician practice, you are usually looking at 2 to 10 TB of active archive plus annual growth, and a retention obligation that, depending on your state, runs anywhere from 7 years to "for the life of the patient plus some." North Carolina, for example, requires adult medical records for 11 years from discharge. Plan for indefinite, then prune deliberately.
3-2-1-1-0, not just 3-2-1
The classic 3-2-1 backup rule (three copies, two media types, one offsite) is fine for a law firm. For healthcare imaging it is a starting line. The current best practice is 3-2-1-1-0:
- Three copies of the data.
- On two different media types.
- One copy offsite.
- One copy that is offline or immutable. This is the ransomware insurance.
- Zero errors after recovery verification. You actually test the restore.
That fourth "1" is why object-lock matters. Wasabi, AWS S3, Azure Blob, and Backblaze B2 all support object-lock or WORM (write-once-read-many) modes that prevent deletion or modification for a defined retention window, even by an account with full credentials. If ransomware hits your PACS and your admin password leaks the same day, object-lock is what saves you. Without it, your offsite backup gets encrypted alongside everything else.
Pieces of an actual setup
For a small practice, a workable architecture looks like this. PACS runs locally with a local backup target (Veeam, or your PACS vendor's snapshot tool). A small NAS like a Synology or QNAP unit holds a daily copy. From there, encrypted replication goes to object-locked cloud storage. Wasabi at roughly $7 per TB per month with no egress fees is the boring favorite because the math is predictable; AWS S3 with Glacier Instant Retrieval works if you already live in AWS and can stomach egress modeling.
Encrypt in transit with TLS 1.2+ and at rest with AES-256, with keys you control if your compliance posture requires it. Get a signed BAA (Business Associate Agreement) from any vendor that touches the data, cloud provider included. No BAA, no PHI. This is non-negotiable under 45 CFR 164.308 and OCR finds this faster than anything else.
Test the restore. Then test it again.
The HIPAA Security Rule requires a contingency plan and calls out testing and revision procedures. In practice that means a quarterly restore of a real study from cold storage to a non-production viewer, confirming pixel data, headers, and patient association came back intact. Most practices skip this. Most practices have never verified their backup works. Do not be most practices.
Document the RTO and RPO you agreed to with the practice, in writing. "We can be reading studies again within 8 hours and we will lose at most 1 hour of new acquisitions" is a real answer. "We have backups" is not.
Syncritech sets up offsite DICOM backup for healthcare SMBs and signs the BAA; if you would rather not own this end to end, we can.
