Healthcare
Hospital data backup and recovery you can test, not just trust
Mindtime backs up the virtual servers, databases and Microsoft 365 environment around your patient record system to its own data centres in the Netherlands and Germany. Standby infrastructure is kept ready for failover and tested every quarter.
In Dutch, German or English.
- NL · DEStored only in our own Tier III data centres in the Netherlands and Germany
- ImmutableObject Lock storage plus an air-gapped copy; every backup job is checked
- ISO 27001 · NEN 7510Audited security, with a data processing agreement in every contract
- NL · DE · ENSupport from people, no offshore call centres or chatbots
In short
Hospitals and specialist clinics need immutable, off-site backups and tested recovery, because most fall under the Cyberbeveiligingswet and medical files must be kept for 20 years. Mindtime backs up servers, databases and Microsoft 365 to its own NEN 7510-audited Dutch and German data centres, with standby infrastructure and quarterly disaster recovery tests.
What's at stake
The data hospitals and specialist clinics can't afford to lose
The patient record system and its databases
Diagnoses, medication, surgery reports and referral letters for every patient live in the EPD and the databases beneath it. For a hospital, that is the clinical memory of the organisation.
Imaging and laboratory archives
Radiology images and lab results build up over many years and are needed again at the next consultation. They usually sit on dedicated archive servers and storage, separate from the EPD.
Operating schedules and logistics
Theatre planning, bed management, stock and staff rosters keep the building running. When these systems fail, planned care stops even if the clinical data itself is intact.
Rules and obligations
What the rules ask of hospitals and specialist clinics
Summarised from the sources listed at the bottom of this page. This is general information, not legal advice.
Twenty-year retention of medical files
The WGBO (Article 7:454 of the Dutch Civil Code) sets a 20-year retention period for the medical file, starting from the most recent change. For a hospital that covers decades of records across every department. [1]
NEN 7510, 7512 and 7513 for care information systems
The Ministry of Health's AVG Helpdesk Zorg names these three as the most important standards for care providers, and states that the care provider and the supplier of an electronic exchange system must ensure the system meets them. [2]
Essential entity under the Cyberbeveiligingswet
A healthcare provider with more than 250 FTE, or above the large-enterprise turnover and balance-sheet ceilings, is an essential entity. Essential entities face both preventive and reactive supervision by the IGJ; medium-sized clinics are important entities with reactive supervision. [3]
Report significant incidents within 24 hours
Organisations under the Cyberbeveiligingswet must report incidents as soon as possible and in any case within 24 hours to the CSIRT and the supervisor. For healthcare, Z-CERT is the designated CSIRT. [4]
When it goes wrong
Ransomware in an independent treatment centre
Illustrative example: an independent treatment centre discovers early one morning that its virtualisation cluster, including the application servers of its patient record system, has been encrypted. The replicated second site is encrypted too, because replication copied the damage. The immutable backups in Mindtime's data centre are untouched; they are scanned for malware and restored through isolated recovery, while critical systems run on Mindtime's standby infrastructure. Planned treatments resume once the IT team and the software supplier have verified the restored systems.
How Mindtime protects it
Backup for hospitals and specialist clinics, workload by workload
- VMware and Hyper-V backupHospital applications run on virtualisation clusters that ransomware targets as a whole.
- Database backupThe data behind patient record, lab and business systems lives in SQL Server, Oracle and similar databases.
- Linux server backupImaging archives and many clinical back-end systems run on Linux.
- Microsoft 365 backupThousands of staff mailboxes and SharePoint sites need a copy outside Microsoft's own retention.
- Disaster RecoveryStandby infrastructure and quarterly failover tests show the board that recovery works before it is needed.
- NIS2 ComplianceHospitals are essential or important entities under the Cyberbeveiligingswet, with business continuity as part of the duty of care.
The software you use, and what we protect around it
| HiX by ChipSoft | Used by hospitals and independent treatment centres, on-premise or in the cloud. If HiX runs in your own data centre, Mindtime backs up the servers and databases it runs on; for HiX in the cloud, check ChipSoft's backup and exit terms. |
|---|---|
| Imaging and lab archives | Archive servers for radiology images and lab results. Mindtime backs up the Linux or Windows servers and the NAS storage they run on. |
| VMware or Hyper-V clusters | Most hospital applications run as virtual machines. Mindtime backs up VMware and Hyper-V environments to its Dutch and German data centres. |
| SQL Server and Oracle databases | Clinical and business applications keep their data in databases. Mindtime backs up SQL Server, Oracle, PostgreSQL, MySQL and MariaDB. |
| Microsoft 365 and Azure | Staff mail, Teams and SharePoint, plus workloads moved to Azure. Mindtime backs both up to its own data centres in the Netherlands and Germany. |
Before you switch
What hospitals and specialist clinics ask us first
We already replicate to a second data centre. Isn't that enough?
Replication copies everything, including encrypted or deleted data. Mindtime adds immutable backups with Object Lock and an air-gapped copy, follows the 3-2-1-1-0 rule and scans backups for malware before you restore.
Our EPD supplier is responsible for the EPD, so why should we care?
For a hosted EPD, the supplier's terms apply to the application. The servers, databases, interfaces, mail and file shares in your own environment are still yours. Mindtime protects those, so the EPD is not the only thing that can be restored.
Will Mindtime meet our procurement and security requirements?
Mindtime is audited against ISO 27001 and NEN 7510, stores data only in its own Tier III data centres in the Netherlands and Germany and requires MFA for admin actions. Every contract includes a data processing agreement, and the IT22 development team can build custom solutions for larger organisations.
FAQ
Questions about backup for hospitals and specialist clinics
Is our hospital an essential or an important entity?
Under the Cyberbeveiligingswet, a healthcare provider with more than 250 FTE, or above the large-enterprise ceilings for turnover and balance sheet, is essential; from 50 FTE it is important. Both must register in the NCSC portal and report significant incidents. Essential entities can expect preventive supervision by the IGJ, not only after an incident.
What is the difference between backup and disaster recovery?
A backup is a protected copy of your data. Disaster recovery adds standby infrastructure on which your systems can run while your own environment is unavailable. With Mindtime, the first test failover typically takes place within 10 days of starting, and DR is tested every quarter after that.
How do we avoid restoring the malware along with the data?
Mindtime scans backups for malware and offers isolated recovery, so restored systems can be checked in a separate environment before they rejoin your network. Because the backups are immutable, the attacker cannot have altered them after they were written, even with stolen admin credentials, as admin actions also require MFA.
Can a single supplier back up both on-premise and cloud workloads?
Yes. Mindtime backs up VMware, Hyper-V and Proxmox, Linux servers and databases in your own data centre, as well as Microsoft 365, Azure, AWS and Google Cloud. All backups are stored in Mindtime's own data centres in the Netherlands and Germany.
See it with your own data
Book a 15-minute demo
We show you a backup and a restore, and answer your questions in Dutch, German or English. No offshore call centres, no chatbots.