Hurricane Preparedness for IT: A Florida Business Checklist

If you run a business in Ormond Beach, Daytona Beach, Port Orange, Palm Coast or DeLand, you already know the routine when a storm shows up in the forecast: shutters, sandbags, a run on bottled water. What usually gets left to the last minute is the office technology, the servers, computers, phones and data that the business actually runs on. Then the power flickers for three days, the server closet takes on two inches of water, and the practice can't see patients for a week after the roads are clear.

Hurricane preparedness for IT is mostly about doing a few things early, when the sky is blue and everyone is calm, so that the last 72 hours before landfall are a short checklist rather than a scramble. A storm that's an inconvenience for your house can be a disaster for a business that loses its patient records or can't answer the phones.

This guide is written for small offices in Volusia and Flagler counties, especially medical and dental practices, accounting firms and other professional offices with 5 to 50 staff. It gives you a timeline (season start, 72 hours out, 24 hours out, after the storm), explains power, surge and flood protection in plain English, and finishes with a reopening checklist you can print and keep in the office.

Why do Florida offices need an IT hurricane plan?

Because the storms that cause the most business disruption aren't always the strongest ones, and the damage that keeps you closed is often to power, water and data rather than the building. Recent Volusia County history makes that point clearly.

In September 2022, Hurricane Ian crossed the state from the Gulf coast and dumped extreme rainfall on east central Florida. According to National Weather Service figures reported by Central Florida Public Media, Ponce Inlet recorded about 21 inches of rain over the event, and New Smyrna Beach and Edgewater each received more than 19 inches. Streets flooded in places that rarely flood, which is exactly the kind of event that puts water into ground-floor offices and server closets.

Six weeks later, Hurricane Nicole made landfall on Florida's east coast as a Category 1 storm. Beaches already weakened by Ian eroded badly, and homes collapsed in Wilbur-by-the-Sea. Volusia County officials estimated Nicole's damage at about $522 million, more than the $377 million they attributed to Ian in the county, as reported by the Associated Press via WLRN. A "weaker" storm caused more damage locally.

The lesson for businesses isn't to panic about every storm. It's that you can't predict which storm will hurt you, or how. A plan that covers power, water, data and communications works whatever the category.

When is hurricane season, and what do watches and warnings mean?

The Atlantic hurricane season runs from June 1 to November 30, with the peak from mid-August through October. NOAA's satellite service notes that September 10 is the statistical peak of the season.

The National Hurricane Center (NHC) uses specific terms, and knowing them helps you time your IT steps. From the NHC glossary:

Evacuation orders come from the county, not the NHC. Volusia County issues them by evacuation zone, which is based on storm surge risk, not on FEMA flood zones. Find your business's zone with the state's Know Your Zone map, and check Volusia County Emergency Management for orders, shelters and its AlertVolusia notification service. Flagler County offices should check Flagler County Emergency Management for the same.

What should you do at the start of hurricane season?

Use June, or better yet May, to do the work that can't be rushed: move data to safety, protect power, set up remote work and phone forwarding, and document your equipment. If you only do one section of this guide, do this one.

1. Get your critical data out of the building

The single most important hurricane step is making sure an up-to-date copy of your data exists somewhere a storm can't reach. Equipment can be replaced in days; patient charts, X-rays, client tax files and accounting records can't be recreated.

• Confirm off-site backups exist and are current. Your backup should copy data to the cloud, or to a data center in another region, automatically and at least daily. A USB drive in the server closet doesn't count. Neither does a drive at the office manager's house two miles away in the same storm path.
• Test a restore. Ask your IT provider to restore something meaningful, like yesterday's practice-management database, to a test machine. Our backup and disaster recovery guide explains how to test properly and what 3-2-1 backup means.
• Back up Microsoft 365 too. Email and files in Microsoft 365 aren't at risk from the storm, but they're still your responsibility to back up against deletion and ransomware. Hurricane recovery is a busy, distracted time, and attackers know it.
• Know your recovery targets. How long can you be closed, and how much recent data can you lose? Those are your RTO and RPO, and they decide how much to invest.

2. Consider moving more to the cloud

Every system that runs in the cloud instead of in your office is one less thing to protect from wind and water. For a small office:

• Email and files: Microsoft 365 (Exchange Online, OneDrive, SharePoint) means staff can work from anywhere with internet. Microsoft signs a HIPAA business associate agreement covering these services, which matters for healthcare offices.
• Practice management or EHR: many vendors now offer cloud-hosted versions. If yours runs on a local server, ask your vendor about cloud hosting options and costs.
• Phones: a cloud phone system or Microsoft Teams Phone keeps working when your office is dark, as long as staff have a device and connection.
• Accounting: cloud-hosted accounting software, or a hosted version of desktop software, removes the local server from the equation.

Cloud isn't automatically better for everything. Dental imaging, for example, often needs to stay local for speed. But knowing which systems are local and which are cloud is the start of a sensible plan. Our dental office IT guide and medical office IT guide cover what typically stays on-site.

3. Protect power with battery backup and surge protection

A UPS (uninterruptible power supply) is a battery unit that keeps equipment running through short outages and lets it shut down safely in longer ones. Every server, network switch, firewall and internet modem should be on one.

Florida power problems in storm season aren't just full outages. You get brownouts (voltage drops), flickers, and surges when power is restored. Each can corrupt data or damage electronics.

UPS basics for small offices:

• Size it for runtime, not just load. For network gear, aim for enough runtime to ride through a typical flicker and to keep internet and phones up for a while during a short outage. For a server, you mainly need enough time for an automatic, clean shutdown.
• Connect the UPS to the server with its management cable or network card so the server shuts itself down automatically when the battery gets low. A UPS that just runs until it dies doesn't protect your database.
• Prefer "line-interactive" or "online/double-conversion" UPS models for servers and network gear. They handle brownouts better than basic "standby" units.
• Replace batteries every 3–5 years. Most UPS units have a self-test; a failed battery often shows a warning light that nobody notices. Check before every season.
• Don't plug laser printers into a UPS. They draw too much power and can overload it.

Add surge protection at two levels: quality surge-protected power strips for workstations, and a whole-building surge protective device installed by an electrician at your electrical panel. Coax and phone lines coming into the building can carry surges too; your internet provider's equipment and network gear should be protected.

4. Decide your generator strategy

A generator can keep you running through a multi-day outage, but it has to be installed and used safely, and it isn't right for every office.

Options:

Ready.gov's power outage guidance is blunt about carbon monoxide: "Generators and fuel should always be used outdoors and at least 20 feet away from windows, doors and attached garages." Carbon monoxide is colorless and odorless, and portable generators kill people every storm season. If you want a generator to power building circuits, have a licensed electrician install a proper transfer switch.

Generator power is also "dirty," with voltage and frequency swings that sensitive electronics don't like. Run computers and network equipment through a line-interactive or online UPS rather than plugging them straight into a generator.

5. Get equipment off the floor, permanently

Water is the most common cause of equipment loss in Florida storms, and the fix is cheap: nothing important should sit on the floor. Do this now, not 24 hours before the storm.

• Mount servers, switches, firewalls and modems in a wall-mounted or floor-standing rack with the lowest equipment at least a couple of feet off the ground.
• Put UPS units on shelves or a raised platform, not on the floor under desks. (They're heavy, so use a sturdy shelf.)
• Keep tower PCs on desk-height stands or under-desk mounts rather than on carpet.
• Avoid locating the server closet under a roof drain, a window, or a bathroom on the floor above.
• If your office is ground-floor in a flood-prone area, ask whether critical equipment can move to a higher floor or, better, into the cloud.

6. Set up remote work before you need it

If staff can't come to the office for several days, can they work from home? Set this up and test it in June:

• Laptops for key staff (front desk lead, billing, office manager, providers who chart remotely), managed with Intune and encrypted with BitLocker so a laptop taken home isn't a data-breach risk.
• Secure access to cloud systems with multi-factor authentication, and to any on-site systems through a properly configured VPN or remote access service. Remote access to a server only helps if that server and its internet connection are still up; this is another argument for cloud.
• Test from home. Have each remote worker actually log in from home, open the practice-management system, send a secure email, and print or save a PDF.
• Policies. Remind staff that patient and client information stays on managed devices, not personal computers or printed at home and left on the kitchen table.

7. Set up phone forwarding and a storm message

Patients and clients will call. If nobody answers and the voicemail is full, they assume the worst. With a cloud phone system or Teams Phone:

1. Create a storm auto-attendant or closure message in advance ("Our office is closed due to the storm. For emergencies, call…"). Record it now.
2. Set up call forwarding of the main number to one or more cell phones, or to a hunt group.
3. Write down how to switch modes from a phone or the vendor's mobile app, and make sure at least two people can do it.
4. If you still have a traditional on-site phone system, ask your carrier how to forward the main number remotely when the office is down. Many carriers offer this, but you need to arrange it before the storm.

Our small office network, Wi-Fi and phone guide explains cloud phone options in more detail.

8. Plan for the internet going down

Even if your office has power, the neighborhood internet may not. A cellular backup connection can keep payments, cloud applications and phones working. Our dental practice case study shows how automatic cellular failover kept one practice's front desk running when its internet died. Cell networks can also be congested or damaged after a major storm, so failover isn't a guarantee, but it covers the far more common case of a wired provider outage. See also our EHR downtime and internet failover plan.

9. Document your equipment for insurance

A dated inventory with photos and serial numbers makes insurance claims and disaster assistance much easier. FEMA's recovery guidance notes that photographs are "one of the most essential pieces of documentation that substantiates disaster-related damage."

Build or update an inventory each May:

• Every computer, laptop, server, monitor, printer, network device, phone and specialized device (X-ray sensors, intraoral cameras, lab equipment).
• Make, model, serial number, purchase date, approximate cost.
• A photo of each item in place, and wide photos of each room.
• Store the inventory in the cloud (SharePoint, for example), not just on the office server.

Ready.gov's hurricane page also recommends keeping insurance policies and important documents up to date, with copies in a secure, password-protected digital space.

10. Review insurance coverage

Talk to your agent before the season, not after:

• Does your commercial property policy cover wind and water damage to equipment? What's the windstorm deductible?
• Do you have flood insurance? Standard policies usually exclude flood. Ready.gov notes there's typically a 30-day waiting period before new flood coverage takes effect, so you can't buy it when a storm is already in the forecast.
• Do you have business interruption coverage, and what triggers it?
• Does your cyber insurance policy have requirements, such as backup testing, that you're meeting?

Our cyber insurance requirements checklist covers the cyber side.

11. Write it down and assign people

A plan only works if people know their part. A one-page IT storm plan should list:

• Who decides when the office closes and reopens.
• Who confirms backups and shuts down systems.
• Who switches the phones.
• Who contacts the IT provider and vendors.
• How staff will communicate (a group text that doesn't depend on office systems).
• Where the printed plan, inventory and vendor contacts live.

Ready Business has free planning toolkits, including a hurricane toolkit, if you want a structured template for the wider business plan.

Season-start checklist

• Off-site backups confirmed and a restore tested
• Microsoft 365 backup in place
• UPS on every server, switch, firewall and modem; batteries tested
• Server shuts down automatically on low battery
• Whole-building surge protection checked
• Generator plan decided; transfer switch installed if needed
• All equipment off the floor
• Laptops and remote access tested from home
• Phone storm message recorded and forwarding tested
• Cellular backup internet in place
• Equipment inventory with photos and serial numbers stored in the cloud
• Insurance coverage reviewed, flood coverage active
• Evacuation zone confirmed; AlertVolusia (or Flagler alerts) set up
• One-page IT storm plan printed and shared

What should you do 72 to 48 hours before a storm?

When a storm threatens and a watch is likely, confirm everything is backed up, prepare staff to work remotely, and start protecting equipment. This is the time to fix anything the season-start check missed.

1. Check backup status. Ask your IT provider to confirm last night's backups succeeded and that the cloud copy is current. If anything has failed, run it now.
2. Run an extra backup of critical systems at the end of the business day.
3. Charge everything. Laptops, phones, power banks, cellular hotspots.
4. Send laptops home with the staff who'll need them, along with chargers and any VPN instructions.
5. Confirm remote access works for each person who'll be working from home.
6. Print essentials. The next week's schedule, a patient or client contact list (stored securely), vendor and IT contacts, insurance policy numbers, and the IT storm plan.
7. Fill your generator fuel if you have one, and test-run it.
8. Tell patients and clients. Update your website banner and Google Business Profile hours if you're likely to close, and prepare the phone message.
9. Check your evacuation zone and county orders. If you're in a zone likely to be evacuated, plan to finish shutdown before the order.

What should you do 24 hours before landfall?

When a warning is issued or landfall is a day away, shut down cleanly, unplug, elevate and protect equipment, switch the phones, and leave. Don't wait until the wind picks up.

Final shutdown checklist

1. Confirm a final backup completed and the cloud copy is up to date. Get a written or emailed confirmation from your IT provider.
2. Switch the phones to the storm message and forwarding.
3. Notify the IT provider that you're shutting down, so monitoring alerts about devices going offline aren't treated as an emergency.
4. Shut down servers properly through the operating system, not by pulling the plug. Then shut down workstations.
5. Turn off and unplug computers, monitors, printers, and the server. Unplug UPS units from the wall too, after the equipment on them is off. Ready.gov notes that "power may return with momentary surges or spikes that can cause damage."
6. Decide what stays on. Some offices leave the internet modem, firewall and one switch on a UPS so remote monitoring and cloud phones keep working until power fails. That's fine if the equipment is off the floor and protected; just know it will go down when the UPS runs out.
7. Elevate and bag. Move anything still at floor level up onto desks or shelves. Cover equipment near windows with plastic sheeting or heavy trash bags, secured with tape. Move equipment away from windows and exterior doors.
8. Take the critical stuff with you if appropriate. Some offices take the backup appliance or a portable drive with an encrypted copy of critical data when evacuating. Only do this if it's encrypted, and don't make it your only off-site copy.
9. Photograph the office as you leave it. These "before" photos help with insurance.
10. Lock up and leave in time to deal with your own home and family.

What to grab on the way out

What should you do during the storm?

Stay safe and stay off the roads; your IT plan should not require anyone to be at the office during a storm. If staff are working remotely, keep them focused on essentials and on their own safety.

• Monitor alerts from the NHC, local media, NOAA Weather Radio and your county's emergency alerts.
• Use phones and data sparingly to save battery.
• Don't try to "check on the server" remotely in ways that power things back up. If equipment went down, leave it down.
• Expect a lot of storm-themed scams afterward: fake FEMA messages, fake insurance adjusters, fake invoices from contractors. Remind staff to be careful with links and attachments; see our phishing and business email compromise guide.

What should you do after the storm?

Only return when authorities say it's safe, check for water and electrical hazards before touching anything, and power up in a deliberate order once electricity is stable. Rushing to turn things on is how equipment that survived the storm gets destroyed.

Before turning anything on

1. Safety first. Don't enter if there's structural damage, standing water near outlets, or a smell of gas. Follow county guidance on re-entry.
2. Photograph everything before you move or clean anything. Wide shots of each room, close-ups of damaged equipment, water lines on walls. FEMA advises you to "take photos and make a list of damages" and file with your insurer before applying for assistance.
3. Check for water. Look at the floor around equipment, the ceiling above it, and inside the server rack. Any device that got wet must stay off until it's inspected. Powering on a wet device can short it out permanently, even if it would have been salvageable after drying.
4. Check that power is stable. If utility power is flickering or the building is on an unstable generator, wait.
5. Check humidity. Days without air conditioning in a Florida summer leave equipment damp. Let the air conditioning run for several hours before powering on electronics.

Power-up order

Bring systems back in a logical sequence so each one finds what it needs:

1. Electrical: confirm panel, surge protection and UPS units are OK.
2. Internet: modem or ONT (the fiber box from your provider).
3. Firewall.
4. Network switches and Wi-Fi access points.
5. Servers (wait until fully started).
6. Workstations, printers and specialty devices.
7. Phones: switch the phone system back from storm mode.

Verify before you open

• Can each workstation reach the practice-management or line-of-business system?
• Do imaging devices and sensors connect and capture?
• Can you send and receive email and secure email?
• Do payments and card terminals work?
• Are backups running again? Check that the first post-storm backup succeeds.
• Are security tools (antivirus, EDR, Intune compliance) reporting in?

If equipment is damaged

• Don't throw anything away until your insurer says so; they may want to inspect it.
• Any device that held patient or client data (PC, server, copier with a hard drive, phone) must be disposed of securely, with drive destruction documented. A water-damaged PC in a dumpster is still a potential data breach.
• Restore from backup to replacement hardware or the cloud. This is when your DR plan pays for itself.
• Keep receipts for replacement equipment, emergency labor and temporary space. FEMA advises keeping records of repairs and cleanup costs.

Reopening checklist

Print this and keep it with your storm plan.

• Building cleared as safe; power stable for several hours
• "After" photos taken before cleanup
• No water on or above any equipment; wet devices tagged "do not power on"
• Air conditioning running; space dry
• UPS units and surge protection checked
• Internet, firewall, switches and Wi-Fi up, in that order
• Servers started and services verified
• Workstations, printers, imaging and specialty devices tested
• Phone system switched back from storm mode; voicemail cleared
• Email, secure email and payment systems tested
• First post-storm backup completed successfully
• Security tools reporting; any devices offline for days updated
• Damaged equipment documented and reported to insurer
• Devices with data held for secure disposal
• Website and Google Business Profile hours updated
• Staff briefed; lessons learned written into the plan

Scenario walk-throughs

Here's how the same storm plays out differently for three typical Volusia County offices. These are composite scenarios to illustrate the plan, not client stories.

Dental office in Port Orange: imaging stays local

A three-dentist practice has its practice-management database and imaging on a server in a ground-floor closet. Patient records must be protected under HIPAA, and the practice can't see patients without X-rays.

Season start: The IT provider confirms that the server is backed up nightly to an immutable cloud copy and every few hours to a local appliance, and runs a test restore. The server, switch and firewall go into a wall-mounted rack. Batteries in both UPS units are replaced. The office records a storm phone message and tests forwarding to the office manager's cell. The front desk lead gets a managed laptop.

72 hours out: Backups confirmed. Next week's schedule printed. Patients are contacted about likely closure.

24 hours out: Final backup confirmed by email. Phones switched to storm mode. Server shut down properly and everything unplugged. Intraoral sensors and cameras are packed in their cases and moved to an upper shelf.

After: Water came under the front door, about an inch deep, but nothing was on the floor. Once power is stable and the air conditioning has run overnight, the IT provider talks the office manager through the power-up order by phone. Imaging and scheduling work. The first backup runs that night. The practice reopens as soon as roads and staff allow.

Medical office in Daytona Beach: cloud EHR, local everything else

A family medicine practice uses a cloud EHR, Microsoft 365 for email and files, and a cloud phone system. The only on-site systems are the network, a few workstations, printers and a vaccine refrigerator.

Season start: Because the important data is already in the cloud, the plan focuses on access and continuity. Two providers and the office manager have managed laptops. Cellular failover is installed on the firewall. The practice confirms with its EHR vendor how to access the system from home and what the vendor's own disaster plan is. The vaccine refrigerator has its own alarm and backup power plan, coordinated with the practice's storage requirements.

During and after: The office is closed for two days without power. Providers handle urgent messages and telehealth from home through the cloud EHR. Phones forward to the on-call cell phone. When power returns, the practice reopens quickly because there's very little on-site technology to restore. This is the strongest case for moving systems to the cloud before a storm.

CPA firm in Ormond Beach: storm during extension season

An eight-person accounting firm has a local server running tax software and stores client files in SharePoint. A storm threatens in late September, a few weeks before the October 15 extended filing deadline for individual returns.

Season start: The firm confirms its tax software data is backed up off-site and that the vendor supports restoring to new hardware. Staff laptops are managed and encrypted, and remote access to the tax server is configured through a secure gateway with MFA. Client files in SharePoint are backed up separately.

72 hours out: Staff take laptops home. The firm checks whether the IRS has announced disaster tax relief for affected counties, which it sometimes does after a federal disaster declaration, and notes that relief has to be confirmed for the specific counties named.

After: The office loses power for four days. The server is down, but because the firm's plan included a cloud restore option, the IT provider restores the tax software to a temporary cloud server from the off-site backup, and staff keep working from home. When power returns, the on-site server is brought back and data is synced. Accounting firms have their own safeguards obligations; see our IT security guide for CPA firms.

What extra steps do medical and dental practices need?

Healthcare offices have a legal duty, not just a business reason, to plan for storms. The HIPAA Security Rule's contingency plan standard requires covered practices to have a data backup plan, a disaster recovery plan and an emergency mode operation plan for systems holding electronic patient information, and it names natural disasters specifically.

In practice, your hurricane plan is a big part of that contingency plan. Make sure it covers:

1. Emergency mode operations. How will you look up allergies, medications and appointment details if systems are down? How will you protect paper records and printed schedules while working from paper? Lock them up, and shred them when the outage is over.
2. Secure remote access. Clinicians charting from home must use managed, encrypted devices and secure connections, not a personal tablet or a family computer.
3. Vendor contingency. Ask your EHR, imaging and practice-management vendors what their own disaster plans are, and get their emergency support numbers on paper.
4. Device disposal after damage. Water-damaged workstations, servers and copiers still contain patient data. Document secure destruction.
5. Breach assessment. If equipment containing patient data is lost or stolen in the chaos, treat it as a potential breach and follow your HIPAA breach response plan.
6. Document the event. Afterward, record what happened, what worked and what didn't, and update your plan. That record is evidence that you test and revise your contingency plan, which the Security Rule expects.

Our HIPAA Security Rule checklist and the free HIPAA security checklist tool help you check the rest of your safeguards.

Costs: what hurricane-proofing your IT typically involves

Most hurricane preparedness for a small office is inexpensive compared to the cost of being closed. The bigger investments, like a standby generator or moving to cloud systems, have benefits all year.

To put the investment in context, use our Downtime Cost Calculator to estimate what a day of closure costs your office. For most practices, a week closed costs far more than a year of good backups and a few UPS units.

Mistakes we see every season

These are the avoidable problems that come up after almost every storm.

1. The only backup is in the building. A USB drive next to the server isn't off-site.
2. Nobody tested the restore. The cloud backup exists but has been failing for months.
3. Equipment on the floor. An inch of water is enough to destroy a UPS or tower PC.
4. UPS batteries dead. The unit beeps for a second and the server crashes anyway.
5. Powering on wet equipment. Turning it on is what kills it.
6. Phones not forwarded. Patients assume the office is gone.
7. Remote access never tested. Staff discover on day two that their home computers can't connect.
8. No photos. Claims drag on without "before" and "after" documentation.
9. Throwing away devices with data on them. A breach on top of a storm.
10. Falling for storm scams. Fake FEMA emails and fake vendor invoices spike after storms.

Questions to ask your IT provider before the season

1. When did you last test restoring our critical systems from the off-site backup, and how long did it take?
2. Is our off-site backup outside the region, and is it protected from deletion?
3. Which of our devices are on a UPS, and when were the batteries last replaced?
4. Will our server shut down automatically if the UPS battery runs low?
5. Can our key staff work from home today? Have we tested it?
6. How do we switch our phones to storm mode, and who can do it?
7. If our office is unusable for two weeks, how and where would you restore our systems?
8. Do you have a current inventory of our equipment with serial numbers?
9. What will you be monitoring during the storm, and how will you contact us?
10. After the storm, will you walk us through the power-up and verification steps?

The bottom line

Hurricane preparedness for IT comes down to a few things done early: get your data safely out of the building with backups you've tested, put critical equipment on battery backup and off the floor, set up remote work and phone forwarding, and document your equipment for insurance. Then, when the forecast cone points at Volusia or Flagler County, the last 72 hours are a short checklist instead of a scramble, and reopening is a matter of hours rather than weeks.

We're based in Ormond Beach and work with practices and small businesses across Volusia and Flagler counties. If you'd like help building your IT storm plan, testing your backups, or setting up remote work and phone forwarding before the next storm, see our IT services and healthcare IT pages, or get in touch.