On Dec 5, 2008, at 5:21 PM, Schneider, John wrote:

 Tim,   
        In the world of healthcare, it is not unusual for the
application vendor to provide the server and application and
support the
whole shootin' match themselves.  Sometimes the customer can talk the
vendor into allowing modifications to "their" server, as in a TSM
client, but sometimes they won't do it.  Sometimes they won't even let
you log in to "their" server. So the vendor will configure shares or
some such method to allow you access from outside, and you have to
roll
your own solution.

Following that vendor logic, it would seem that the contract
involving their participation in the site should stipulate
comprehensive details of data privacy, data integrity (i.e., backup
and restoral), and all other legal aspects of such data.  Something's
missing in the whole arrangement if the contractee has to try to
invent some way of backing up and restoring data which circumvents
restrictions.  If the vendor supports the whole thing themselves,
then they should be taking care of all this.

   observing from afar,  Richard Sims