We use idrive and have been very pleased with it. Even doubling up on the plans you should get in much cheaper than that.

I would looks at Backblaze or Amazon S3.
I think S3 glacier is even cheaper.

I would be concerned about storing this sort of stuff at his warehouse if it is classified as ePHI.

There are plenty of ways to do long term storage in the cloud in a way (encrypted) that meets regulatory requirements.

This, if it doesn't have to be stored on-prem.  Glacier would be my recommendation.

Backblaze

+1

Check your math.
S3 pricing

ETA: some options have transfer cost.

For static data with limited retrieval, I'd go with Amazon cold storage. It's dirt cheap for what you get.

Something nobody has asked is what kind of internet you have at your business?

If you have DSL you'll need to find someone that will let you send them the initial backup offline.  Fiber isn't as big of a deal, however, it will still take awhile event with gigabit.

Also, I'd switch to RAID 10 as RAID 5 is the devil.

Using a service like AWS is very dependent on how frequently you plan on accessing the data. You can store stuff in Amazon cheap if you just need to occasionally retrieve it.

I'll echo the glacier plan. Also you can have them send you a snowball that you fill with your data, send it back, and then just start sending deltas.

Going by my math (and I'm drunk), you need roughly 2 TB of archival storage per year. That's actually not a lot.

I keep my important data on M-Discs.




That's 2.5 TB of storage for ~$250 that will last you about a year.

You'll have to store them yourself, though.

Also, here's a review of M-Discs.

EDIT: You'll need on-disc encryption for PHI.

Are you bound by any kind of laws regarding data retention? Like are you clear to dispose of data after a certain number of years? As you can see, just keeping it forever is not without cost.

I never knew the snowball existed.
I was looking at deep archive but the initial upload had me a bit overwhelmed based upon the how-to I’ve been reading
This is definitely an option
Thank you for posting.

We use a cloud service to backup our EMR. It takes a long time every night.
We have raid 5 in office.

Lazy people round off. IT people live and charge in binary. Your average user doesn't know any better. But if you are looking to store big data that "rounding" adds up.

Sweet baby cheesecake!

I do want to address one thing you said in your original post. If you go with two arrays, you don't want them to be in perfect sync. If they are in perfect sync and you get hit with a crypto blackmail thing then your backup gets encrypted too. You want snapshots so you can roll back.

Snapshots are an absolute must.

That quote is fucking STUPID cheap for HIPAA compliant managed(encryption requirements in transit and at rest, testing protocols, risk assessment, security requirements, administrative controls and BAA) backup solution, which tells me it's not HIPAA compliant and neither is your practice.

Everyone in this thread is giving very very poor advice.

You’re not half bad at that, but my teefs look like dis

OK,  so instead of shitting in the thread provide some useful information.

rsync.net

and:

HIPAA

The package arriving at your office, mark it "Return to Sender!"

I can't speak to HIPAA specific requirements.

That said...

I back up my critical data on an encrypted external drive. You could easily set up a larger raid enclosure that is semi portable. I keep one drive locked in a fire safe, one at a different location, and one with me. All copies are encrypted, and synced regularly.

In a situation where you're only adding data and not really removing, the portable drive could be smaller and only contain the new data to add to the archive.

You mean RAID 6.  Allows failure of any 2 drives and protects against data corruption by a silently failing drive that is lying to the controller.

I'm going to focus on the technical aspect of just backing up the data and avoid the HIPPA angle for now.  I spent 10 years in IT in hospitals so I can go down that road if you need it.

So I'm not current on AWS or Azure but Glacier would be about $100/month for 24TB if my math is right.  Azure could be even cheaper based on their archive tier of $0.00099 per GB.

The question is will there be any other costs or services needed to get it setup and are you managing it or paying someone.  You'd really need to get someone that knows the services to sit down and price it all out for comparison.

$900/month seems high but I'm not sure what hardware and levels of service/security are being provided.  If you could get any detailed info from him that could help.  You could build a box for an up front cost of under the $11k but what is the hardware?  The servers we buy with no storage can run $15-20k due to CPU and RAM costs.  You'd be switching the components around but quality gear costs money.   Also, are there any software licensing costs for OS or replication applications?

You could buy or get someone to build to your requirements a box that would work.  RAID 6 is good for archival data as it allows 2 drive failures but you lose performance in writing data.  RAID 5 or 10 could work as well, there are just trade offs with any of them.  You could replicate that to an identical box somewhere off site or to the cloud.  If you use an identical box, ideally it's far enough from your office that it would not be impacted by the same disaster type event.  This is where cloud services are nice.  You could have your archive target in Ohio or on the west coast as an example.  Something from Synology might work, but I'd have to look at their current offering as I'm assuming you need it to be encrypted at rest.

One thing you have to think about is who is going to manage the solution.  Is it going to be you if you go with a cloud solution or an alternative on-prem solution?  Are you happy with your IT provider?  Will they support any solution you decide on?  

Are you just looking for a replication solution?  Typically a good strategy is to backup the data locally and store a local copy, and also replicate a copy off site.  If you aren't doing an actual backup and just replicating the data as it sits on the server.  What happens if someone deletes the data accidentally or maliciously?  Does the replicated copy also get deleted as it's just a mirror of the main server?  

Shoot me a message if you'd like to chat about it or have other questions.

Glacier Deep Archive is the same price.

As has been said, RAID is not a backup solution, it's a fault tolerance solution. Basically, RAID has everything written to it, even a RAID 1 mirror. If you delete something, it's gone. It's gone on all of the drives. If something is corrupted, it's corrupted. What RAID gets you is tolerance for hardware failure. One of your drives goes kaput, you replace it and it rebuilds.


The suggestion for S3 Glacier would likely be good pending pricing. If you don't need to have constant or fast access to that data, if it's just an archive, that should work. They can send you a "snowball", which is a portable hard drive storage thing, which can be faster copying your data to than to upload it over the 'net. You then send the snowball back, and they import it to your S3 bucket.  

The biggest question you need to ask is "how fucked will I be if I lose all of this data?" Then realize one copy is none, two is one. Have a backup of your shit.