A nightly copy, a current certificate and no odd warnings.

The padlock does get looked at in healthcare

Anybody about to leave their name and phone number on a clinic’s form will notice whether the browser says the site is secure. If it says otherwise, they do not leave them. The certificate is there from day one and renews itself, precisely so that doubt never arises.

Being able to restore is not optional: it is in article 32

The GDPR lists the required security measures and two of them describe exactly this: being able to restore the availability and access to personal data in a timely manner after an incident, and regularly verifying that the ability works. A clinic handles special category data, so that bar is looked at more closely than in other sectors.

What gets kept from a healthcare website

The page for each treatment, which took time to write and review; the photos of the centre and the team; the legal texts with their date; and the appointment requests received. It is not the medical record — that lives in your management software and has its own backups — but it is everything else.

And testing it before needing it

A copy nobody has ever restored is an assumption. The test happens cold, on a quiet day, so that nobody discovers at eight on a Monday morning that the file was incomplete.

The same thing, explained in general: Daily backups