EHR Downtime: Running a Practice When the Record System Is Down

Every practice depends on its electronic health record. Scheduling, charting, prescribing, billing, and results all run through it. When it goes down, whether from ransomware, a vendor outage, an internet failure, or a failed update, the question is not whether patients keep arriving. They do. The question is whether your staff knows what to do next.

The HIPAA Security Rule expects you to have answered that question in advance. This post covers what the rule requires, what good downtime procedures look like in a small or mid-sized practice, and what to test before you need them.

What HIPAA requires

The contingency plan standard at 45 CFR 164.308(a)(7) requires policies and procedures for responding to an emergency or other occurrence, such as fire, vandalism, system failure, or natural disaster, that damages systems containing electronic protected health information. It has five implementation specifications:

• Data backup plan (required). Procedures to create and maintain retrievable exact copies of ePHI.
• Disaster recovery plan (required). Procedures to restore any loss of data.
• Emergency mode operation plan (required). Procedures to continue critical business processes while protecting ePHI during an emergency.
• Testing and revision procedures (addressable). Periodic testing and revision of the plans.
• Applications and data criticality analysis (addressable). Assessing which applications and data matter most.

There is also a required emergency access procedure in the technical safeguards at 164.312(a)(2)(ii): a way to obtain necessary ePHI during an emergency.

Addressable does not mean optional. It means you assess whether the specification is reasonable and appropriate for your practice, implement it if so, and document your reasoning either way. For testing, it is very hard to argue that never testing your plan is reasonable.

The NIST Cybersecurity Framework 2.0 covers the same ground in its Recover function (RC.RP, incident recovery plan execution), and HHS's voluntary 405(d) Health Industry Cybersecurity Practices publication is a useful companion for smaller practices.

Start with what matters most

The criticality analysis is the step most practices skip, and it is the one that makes the rest manageable. List your systems and ask, for each one: if this is unavailable, what stops, and how long can we tolerate it?

For most practices the list looks something like this:

1. The EHR and practice management system
2. E-prescribing
3. Phones and patient communication
4. Imaging and diagnostic devices
5. Lab interfaces and results
6. Billing and clearinghouse connections
7. Email and file storage

Rank them. Decide which ones you need back first. That ranking drives your backup design and your recovery order, and it tells your IT provider what to restore first.

What downtime procedures should include

An emergency mode operation plan is mostly about people and paper. It should answer:

• Who declares downtime, and how staff are told.
• How patients are checked in without the scheduling system. Keep a current printed or offline copy of the next few days' schedule, refreshed on a regular cycle.
• How clinicians document care. Paper downtime forms for visit notes, orders, vitals, and medication administration, stored where staff can find them.
• How prescriptions are handled if e-prescribing is unavailable, consistent with your state's rules and your prescribers' guidance.
• How results are received, including phone contacts for your labs and imaging partners.
• How paper is protected. Downtime documents are PHI. They need a secure place to sit until they are entered back into the system.
• How data is reconciled once systems return, and who checks that everything was entered.

Keep the procedures short. During an outage, nobody reads a forty-page binder. A one-page checklist per role works better.

Plan for the ransomware case

A vendor outage and a ransomware attack are very different. In a vendor outage, your systems are fine and you are waiting. In a ransomware event, your own systems may be untrustworthy, your network may need to be disconnected, and recovery may take much longer.

For that case, your plan should consider:

• Backups that are isolated from the main network and protected from deletion, so an attacker who gets admin access cannot destroy them.
• A recovery order based on your criticality ranking.
• Contact information for your insurer, IT provider, EHR vendor, and counsel that does not depend on email or a file server that may be encrypted.
• How you will communicate with staff if email and the phone system are down.

Our post on building an incident response plan you will actually use covers the response side in more detail.

Test it

The most common failure is a plan that has never been tried. Testing does not need to be dramatic:

• Restore test. Ask your IT provider to restore a real system from backup and time it. Compare the result to what you said you could tolerate.
• Tabletop exercise. Walk the front desk, clinical staff, and billing through a scenario. Where do the downtime forms live? Who calls the lab? How do we know which patients are coming in this afternoon?
• Short drill. Some practices run a planned brief downtime during a quiet period to practice the paper workflow.

Write down what you learned and update the plan. That record is also your evidence that testing happened.

Where this fits in your risk analysis

Your HIPAA risk analysis should identify availability risks to ePHI, not just confidentiality risks. A practice with no tested recovery capability has a significant availability risk, and the contingency plan is how you address it. Our post on what an accurate and thorough risk analysis means for a small practice covers that process.

The HIPAA Security Rule overhaul proposed in January 2025 would add more specific contingency planning requirements, but it remains a proposal. The current rule is the one in force today.

How we help

TRNSFRM works with healthcare practices in Ohio on backup design, recovery testing, and downtime planning, and we sign business associate agreements with our healthcare clients. See our healthcare page and HIPAA overview. Check your current state with the free compliance checklist, or book a free 45-minute Compliance Gap Audit.