--- title: "EHR Downtime: Running a Practice When the Record System I..." url: https://trnsfrm.tech/blog/ehr-downtime-procedures-contingency-plan description: "When the EHR goes down, patients keep coming. What HIPAA's contingency plan standard requires, what good downtime procedures look like, and what to test first." lang: en --- Back to blog (https://trnsfrm.tech/blog) Image: EHR Downtime: Running a Practice When the Record System Is Down (https://trnsfrm.tech/blog-covers/incident-response.jpg) By Jeff Dennis (https://www.linkedin.com/in/jefferydennis), Founder & CEO October 27, 2026 # EHR Downtime: Running a Practice When the Record System Is Down Healthcare (https://trnsfrm.tech/blog?category=Healthcare)#hipaa #healthcare #contingency-plan #it-resilience Every practice depends on its electronic health record. Scheduling, charting, prescribing, billing, and results all run through it. When it goes down, whether from ransomware, a vendor outage, an internet failure, or a failed update, the question is not whether patients keep arriving. They do. The question is whether your staff knows what to do next. The HIPAA Security Rule expects you to have answered that question in advance. This post covers what the rule requires, what good downtime procedures look like in a small or mid-sized practice, and what to test before you need them. ## What HIPAA requires The contingency plan standard at 45 CFR 164.308(a)(7) (https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308) requires policies and procedures for responding to an emergency or other occurrence, such as fire, vandalism, system failure, or natural disaster, that damages systems containing electronic protected health information. It has five implementation specifications: - **Data backup plan (required).** Procedures to create and maintain retrievable exact copies of ePHI. - **Disaster recovery plan (required).** Procedures to restore any loss of data. - **Emergency mode operation plan (required).** Procedures to continue critical business processes while protecting ePHI during an emergency. - **Testing and revision procedures (addressable).** Periodic testing and revision of the plans. - **Applications and data criticality analysis (addressable).** Assessing which applications and data matter most. There is also a required emergency access procedure in the technical safeguards at 164.312(a)(2)(ii): a way to obtain necessary ePHI during an emergency. Addressable does not mean optional. It means you assess whether the specification is reasonable and appropriate for your practice, implement it if so, and document your reasoning either way. For testing, it is very hard to argue that never testing your plan is reasonable. The NIST Cybersecurity Framework 2.0 covers the same ground in its Recover function (RC.RP, incident recovery plan execution), and HHS's voluntary 405(d) Health Industry Cybersecurity Practices publication is a useful companion for smaller practices. ## Start with what matters most The criticality analysis is the step most practices skip, and it is the one that makes the rest manageable. List your systems and ask, for each one: if this is unavailable, what stops, and how long can we tolerate it? For most practices the list looks something like this: 1. The EHR and practice management system 2. E-prescribing 3. Phones and patient communication 4. Imaging and diagnostic devices 5. Lab interfaces and results 6. Billing and clearinghouse connections 7. Email and file storage Rank them. Decide which ones you need back first. That ranking drives your backup design and your recovery order, and it tells your IT provider what to restore first. ## What downtime procedures should include An emergency mode operation plan is mostly about people and paper. It should answer: - **Who declares downtime,** and how staff are told. - **How patients are checked in** without the scheduling system. Keep a current printed or offline copy of the next few days' schedule, refreshed on a regular cycle. - **How clinicians document care.** Paper downtime forms for visit notes, orders, vitals, and medication administration, stored where staff can find them. - **How prescriptions are handled** if e-prescribing is unavailable, consistent with your state's rules and your prescribers' guidance. - **How results are received,** including phone contacts for your labs and imaging partners. - **How paper is protected.** Downtime documents are PHI. They need a secure place to sit until they are entered back into the system. - **How data is reconciled** once systems return, and who checks that everything was entered. Keep the procedures short. During an outage, nobody reads a forty-page binder. A one-page checklist per role works better. ## Plan for the ransomware case A vendor outage and a ransomware attack are very different. In a vendor outage, your systems are fine and you are waiting. In a ransomware event, your own systems may be untrustworthy, your network may need to be disconnected, and recovery may take much longer. For that case, your plan should consider: - Backups that are isolated from the main network and protected from deletion, so an attacker who gets admin access cannot destroy them. - A recovery order based on your criticality ranking. - Contact information for your insurer, IT provider, EHR vendor, and counsel that does not depend on email or a file server that may be encrypted. - How you will communicate with staff if email and the phone system are down. Our post on building an incident response plan you will actually use (https://trnsfrm.tech/blog/building-an-incident-response-plan-you-ll-actually-use) covers the response side in more detail. ## Test it The most common failure is a plan that has never been tried. Testing does not need to be dramatic: - **Restore test.** Ask your IT provider to restore a real system from backup and time it. Compare the result to what you said you could tolerate. - **Tabletop exercise.** Walk the front desk, clinical staff, and billing through a scenario. Where do the downtime forms live? Who calls the lab? How do we know which patients are coming in this afternoon? - **Short drill.** Some practices run a planned brief downtime during a quiet period to practice the paper workflow. Write down what you learned and update the plan. That record is also your evidence that testing happened. ## Where this fits in your risk analysis Your HIPAA risk analysis should identify availability risks to ePHI, not just confidentiality risks. A practice with no tested recovery capability has a significant availability risk, and the contingency plan is how you address it. Our post on what an accurate and thorough risk analysis means for a small practice (https://trnsfrm.tech/blog/hipaa-security-risk-analysis-small-practice) covers that process. The HIPAA Security Rule overhaul proposed in January 2025 would add more specific contingency planning requirements, but it remains a proposal. The current rule is the one in force today. ## How we help TRNSFRM works with healthcare practices in Ohio on backup design, recovery testing, and downtime planning, and we sign business associate agreements with our healthcare clients. See our healthcare page (https://trnsfrm.tech/industries/healthcare) and HIPAA overview (https://trnsfrm.tech/frameworks/hipaa). Check your current state with the free compliance checklist (https://trnsfrm.tech/compliance-checklist), or book a free 45-minute Compliance Gap Audit (https://trnsfrm.tech/book). ## Keep exploring More from the TRNSFRM team. ### All Blog Posts Browse every cybersecurity and IT article. https://trnsfrm.tech/blog ### Case Studies Real CMMC, NIST, and FTC outcomes. https://trnsfrm.tech/case-studies ### Free Compliance Checklist Score yourself across 47 controls in 10 minutes. https://trnsfrm.tech/compliance-checklist ### Compliance Frameworks CMMC, NIST 800-171, ISO 27001, HIPAA, FTC, ITAR. https://trnsfrm.tech/governance ### Cybersecurity Operations 24/7 MDR, SOC, and threat response. https://trnsfrm.tech/cybersecurity ### IT Resilience Framework Assess, Remediate, Operate, Improve. A continuous lifecycle. https://trnsfrm.tech/it-resilience-framework ### ITAR Compliance Checklist Work through ITAR readiness control by control. https://trnsfrm.tech/frameworks/itar ### MSP Partner Program White-label security and compliance for MSPs. https://trnsfrm.tech/partners/msp ### Choosing a Cybersecurity Firm 2026 buying guide and provider directory. https://trnsfrm.tech/blog/cybersecurity-companies ## More industries we secure Regulated-industry programs built by TRNSFRM. ### Aerospace & Space AS9100, CMMC, ITAR programs for aerospace suppliers. https://trnsfrm.tech/industries/aerospace-space ### Ambulatory Surgery Centers HIPAA-grade IT for ASCs and outpatient surgery. https://trnsfrm.tech/industries/ambulatory-surgery-centers ### Automotive Suppliers TISAX, CMMC, and OEM cyber flow-downs. https://trnsfrm.tech/industries/automotive-suppliers ### Behavioral Health HIPAA + 42 CFR Part 2 for behavioral health providers. https://trnsfrm.tech/industries/behavioral-health ### Defense & DoD Suppliers CMMC 2.0 & NIST 800-171 for the defense industrial base. https://trnsfrm.tech/industries/defense-dod-suppliers ### Dental Practices Real HIPAA compliance for dental groups and DSOs. https://trnsfrm.tech/industries/dental ## Featured cybersecurity insights Deeper reads from the TRNSFRM team. ### Building an Incident Response Plan You'll Actually Use A pragmatic IR playbook, not a shelf binder. https://trnsfrm.tech/blog/building-an-incident-response-plan-you-ll-actually-use ### Cloud Misconfigurations: The #1 Cause of Data Breaches Where teams get cloud wrong — and how to fix it. https://trnsfrm.tech/blog/cloud-misconfigurations-the-1-cause-of-data-breaches ### CMMC 2.0: What Defense Contractors Must Do Now The DIB compliance clock is ticking. https://trnsfrm.tech/blog/cmmc-2-0-compliance-what-defense-contractors-must-do-now ### Deepfake Fraud in the Boardroom: The New CEO Scam Why voice and video attacks now target execs. https://trnsfrm.tech/blog/deepfake-fraud-in-the-boardroom-the-new-ceo-scam ### MFA Bypass Techniques and How to Stop Them Attackers are getting past MFA — here's how. https://trnsfrm.tech/blog/mfa-bypass-techniques-and-how-to-stop-them ### Quantum Computing and the Cryptography Apocalypse Start planning your post-quantum crypto migration. https://trnsfrm.tech/blog/quantum-computing-and-the-cryptography-apocalypse Call Now: +18777776855 ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "logo": "https://trnsfrm.tech/wp-content/uploads/2021/11/trnsfrm-logo.svg", "image": "https://trnsfrm.tech/og-image.png", "description": "Cybersecurity, compliance, and managed IT services for manufacturers, construction, automotive, and healthcare organizations.", "foundingDate": "2008", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "founder": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://trnsfrm.tech/", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ] }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "address": [ { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Columbus", "addressRegion": "OH", "addressCountry": "US" } ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer service", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "areaServed": "US", "availableLanguage": "English" }, "knowsAbout": [ "CMMC", "NIST 800-171", "ISO 27001", "HIPAA", "FTC Safeguards", "ITAR", "Managed IT", "vCISO", "vCIO", "Cybersecurity", "Microsoft GCC High" ], "makesOffer": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity", "url": "https://trnsfrm.tech/cybersecurity", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Governance & Compliance", "url": "https://trnsfrm.tech/governance", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT", "url": "https://trnsfrm.tech/managed-it", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "vCISO", "url": "https://trnsfrm.tech/vciso", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Integration & Implementation", "url": "https://trnsfrm.tech/services/ai", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft GCC / GCC High", "url": "https://trnsfrm.tech/services/microsoft-gcc", "provider": { "@type": "Organization", "name": "TRNSFRM" } } } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "176", "bestRating": "5", "worstRating": "1" }, "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "TRNSFRM", "url": "https://trnsfrm.tech", "publisher": { "@type": "Organization", "name": "TRNSFRM" }, "potentialAction": { "@type": "SearchAction", "target": "https://trnsfrm.tech/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ProfessionalService", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "image": "https://trnsfrm.tech/og-image.png", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "address": { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "priceRange": "$$", "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "BlogPosting", "headline": "EHR Downtime: Running a Practice When the Record System Is Down", "description": "When the EHR goes down, patients keep coming. What HIPAA's contingency plan standard requires, what good downtime procedures look like, and what to test first.", "author": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://www.linkedin.com/in/jefferydennis", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ], "worksFor": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" } }, "datePublished": "2026-10-27T12:23:12.915335+00:00", "publisher": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" }, "image": "https://trnsfrm.tech/blog-covers/incident-response.jpg" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trnsfrm.tech/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://trnsfrm.tech/blog" }, { "@type": "ListItem", "position": 3, "name": "EHR Downtime: Running a Practice When the Record System Is Down", "item": "https://trnsfrm.tech/blog/ehr-downtime-procedures-contingency-plan" } ] } ] } ] ```