# OZI-RIS Downtime, Backup, and Recovery Procedure

## Objectives

- Initial recovery-point objective (RPO): 24 hours; clinical governance should approve a shorter interval before production.
- Initial recovery-time objective (RTO): 4 hours; validate through scheduled restoration drills.
- Keep at least one encrypted backup copy outside the application server and test restoration quarterly.

## Scheduled encrypted backup

Run `scripts/backup-database.ps1` from Windows Task Scheduler using a service account and a password supplied by an approved secret store. Never embed the encryption password in the script or repository.

```powershell
$secret = Read-Host 'Backup encryption password' -AsSecureString
.\scripts\backup-database.ps1 -EncryptionPassword $secret -RetentionDays 30
```

Record the returned path, size, SHA-256 digest, completion time, and off-site copy status in the backup register. Alert administrators when a scheduled backup is absent or fails.

## Clinical downtime

1. Declare downtime and record start time, incident owner, affected services, and last known successful backup.
2. Stop nonessential OZI-RIS changes; do not repeatedly resubmit requests after ambiguous failures.
3. Use approved numbered downtime forms for patient identity, orders, modality activity, critical results, and reports.
4. Verify patient identity using the hospital downtime policy. Never create ad-hoc duplicate identities unless clinically authorized.
5. Communicate critical results through the approved verbal/read-back process and retain the downtime record.
6. Preserve modality and PACS identifiers needed for later reconciliation.

## Restore

1. Obtain incident-owner and database-owner authorization.
2. Isolate the application or enable maintenance mode.
3. Make a pre-restore encrypted backup when the current database remains readable.
4. Verify the archive SHA-256 against the backup register.
5. Restore only into the intended environment:

```powershell
$secret = Read-Host 'Backup encryption password' -AsSecureString
.\scripts\restore-database.ps1 -BackupPath 'C:\secure-backups\ozi-ris-example.7z' -EncryptionPassword $secret -ConfirmRestore
php artisan migrate:status
php artisan test
```

6. Validate patient counts, accession uniqueness, report signatures, foreign keys, user access, and a representative patient/order/report workflow.
7. Record restoration completion, backup source, verification results, and approving officers.

## Post-downtime reconciliation

1. Enter downtime registrations and orders in chronological order using the original clinical times.
2. Match every modality/PACS study to the correct patient, accession, and requested procedure before reporting.
3. Reconcile performed, cancelled, rejected, and incomplete examinations.
4. Enter reports and critical-result communication records with clear downtime attribution.
5. Use controlled patient reconciliation/merge tools for duplicates; never delete a clinical record to conceal a mismatch.
6. A second authorized staff member should verify high-risk identity, critical-result, and finalized-report reconciliation.
7. Close downtime only after all numbered forms are accounted for and discrepancies are assigned.
