3-2-1: three copies of the data, on two different media types, with one copy off-site. Modern practice adds one copy immutable or offline, and zero untested restores. Cloud sync is not a backup — ransomware and deletions replicate to the cloud copy just as fast as they happen locally.
Inventory what actually needs restoring before choosing a product: Microsoft 365 mail and files, line-of-business databases (EHR, estimating, accounting), local file servers, device configurations, and the credentials needed to rebuild access. Microsoft's own retention is not a backup product; third-party Microsoft 365 backup exists for exactly this reason.
Recovery Point Objective (RPO (Recovery Point Objective)) is how much data the business can afford to lose; Recovery Time Objective (RTO (Recovery Time Objective)) is how long it can afford to be down. Ask the owner both questions in plain language — 'how many hours of work can you re-do?' and 'how long can the clinic run on paper?' — and let the answers pick the technology.
A restore test is the only thing that turns backup into recovery. Restore one file monthly and one full system quarterly, write down how long it took, and show the owner the result. That single report is often the most valuable thing an IT (Information Technology) person delivers all year.