Real security is made up of a number of different processes, policies, and technologies. If one part of the security picture is missing then the data is vulnerable. Where are backups kept? Are they in a secure location? While the following example is a fairly rare occurrence, it is a good reminder about backup security.
"A vehicle used by an off-site archive company to transport patient data was broken into on March 17. The University of Miami just made the theft public last week, saying the thieves removed a transport case carrying the school's six computer backup tapes. On those tapes were more than 2 million medical records. In fact, the archive company waited 48 hours before notifying the university itself. A University spokeswoman said the school has stopped shipping backup tapes off-site for now."