EHR Downtime Procedures: What to Put in Writing Before the System Goes Down

If your EHR went down at 9:00 tomorrow morning, who would decide that you are officially in downtime? Who would print the schedule, and how would a clinician know which medications a patient is on? Who would enter the paper notes afterward?

In many small healthcare organizations, the honest answer is “whoever is there.” Downtime procedures exist to replace that answer with names, steps and forms that staff can follow under stress.

This guide is for home health and hospice administrators, practice and clinic managers, rural health clinic and FQHC leaders, and small hospital emergency managers. It covers what federal rules expect, the sections a usable downtime procedure needs, and the gaps that most often turn a short outage into a long one.

Need to prepare your team for EHR downtime?

Forward Security Labs helps healthcare organizations document downtime responsibilities, improve operational continuity procedures, and test decisions through practical tabletop exercises.

Whether you need procedures written, reviewed, or tested, we can discuss a defined scope and price before work begins.

Discuss Your Downtime Needs Explore Tabletop Exercise Options

What counts as EHR downtime

EHR downtime is any period when staff cannot use all or part of the electronic health record. The ONC SAFER Guide on Contingency Planning addresses both planned and unplanned EHR unavailability. Your procedures should cover three situations:

  • Planned downtime: vendor upgrades and maintenance windows. These are announced, so they are the easiest to rehearse.
  • Unplanned downtime: an internet, power, hosting or vendor outage. Duration is unknown at the start.
  • Partial downtime: the EHR works, but something it depends on does not. Examples are e-prescribing, the lab interface, the phone system, the clearinghouse or a single module.

A cyberattack can produce any of the three. It also adds decisions that a power outage does not, which is why it gets its own section below.

What federal rules expect

Federal rules do not require a specific downtime template. HIPAA does require documented contingency procedures, and many Medicare and Medicaid providers have additional emergency preparedness requirements.

  • HIPAA Security Rule. 45 CFR 164.308(a)(7) requires covered entities and business associates to establish, and implement as needed, a contingency plan. A data backup plan, a disaster recovery plan and an emergency mode operation plan are required implementation specifications. Testing and revision, and an applications and data criticality analysis, are addressable. Of these, the emergency mode operation plan comes closest to what most organizations call downtime procedures. It covers how critical business processes continue while systems are impaired.
  • CMS Emergency Preparedness Rule. Medicare and Medicaid participating providers in the provider and supplier types CMS lists must meet emergency preparedness requirements. That list includes hospitals, critical access hospitals, home health agencies, hospices, rural health clinics, FQHCs and ambulatory surgical centers. For home health agencies, 42 CFR 484.102 requires a system of medical documentation that preserves patient information, protects confidentiality, and keeps records secure and available. It also requires the emergency program to be reviewed at least every 2 years, and the plan to be exercised on a set schedule.
  • Physician offices. Independent physician practices are not on the CMS list. HIPAA’s contingency plan requirement still applies to practices that are covered entities.

This is a general summary, not legal or compliance advice. Requirements vary by provider type, state and contract. Confirm what applies to your organization with qualified advisors.

The 10 sections your downtime procedures need

Use this as an outline. Each section should fit on one or two pages, written so a new employee could follow it.

1. Scope and triggers. State which systems the procedure covers: the EHR, plus e-prescribing, scheduling, phones, internet and the patient portal. Define what triggers downtime, and set duration tiers your leadership chooses, for example under 4 hours, 4 to 24 hours, and over 24 hours. Each tier should change what staff do.

2. Authority. Name the role that declares downtime, a backup for that role, and the role that declares recovery. Use roles with current names attached, and review the names every quarter. A plan that depends on one person being on shift is a single point of failure.

3. Notification and communication. List who gets told, in what order, and how: staff, the EHR vendor, the IT provider, the medical director, partner facilities, pharmacies and patients with visits that day. Include an alternate method for when email or phones are part of the outage. Keep this list outside the EHR and outside the network that might be down.

4. Critical functions and priorities. Decide in advance what must continue and what can wait. Medication administration, orders, critical results, referrals and visits for high-risk patients usually come first. Billing, routine charting and reports can usually wait. Clinical priorities should be set by your clinical leadership, not by IT or a template.

5. Paper workflows by role. Write separate steps for the front desk, clinicians, field staff and billing. Say where the downtime forms are kept, how many sets are printed, and who restocks them. Include registration, progress notes, medication administration, orders and visit logs.

6. Information access during downtime. Staff need current patient information without the EHR. Many systems can produce downtime reports, such as the schedule, census, medication lists and allergies. Your procedure should say which reports exist, how often they are generated, and where they are stored. If they are stored on the same server or network as the EHR, a cyberattack can take them out too. Protect printed reports as PHI.

7. Prescriptions, orders and results. Spell out how prescriptions are handled if e-prescribing is down, how labs and imaging will call back critical results, and how verbal orders are documented. List the phone numbers for labs, pharmacies and imaging centers on paper.

8. Cyberattack steps. If staff see a ransom note or signs of an attack, they need short, clear first steps: stop, do not click further, and call the named contact. Technical response belongs to your IT provider. CISA’s ransomware response checklist says to isolate affected systems quickly. It says to power devices down only if they cannot be disconnected from the network, because shutting down can destroy evidence. Your procedure should also name who contacts the cyber insurance carrier and legal counsel. Decisions about paying, reporting and notification belong to leadership with counsel, not to front-line staff.

9. Recovery and back-entry. Recovery is where many plans stop, and it is where errors appear. Define who enters paper documentation into the EHR, in what order, and how it is verified. Cover how scanned versus re-keyed documents are handled, how orders and medications placed during downtime are reconciled, and how billing catches up. Name the role that confirms the record is complete before downtime is formally closed.

10. Testing, training and review. A procedure nobody has practiced is a draft. Walk staff through it at least once a year, record what failed, and update the document. A tabletop exercise is a low-cost way to find gaps before an outage does. Providers covered by the CMS rule also have specific exercise and review cycles to meet.

Gaps that turn a short outage into a long one

Watch for these common failure points:

  • The person named as decision-maker left the organization last year.
  • Vendor and IT phone numbers exist only inside the EHR or a shared drive that is also down.
  • Downtime forms were never printed, or the box is in a locked office.
  • Downtime reports are generated, but on the same network the attack encrypted.
  • Nobody owns back-entry, so paper notes sit in a folder for weeks.
  • The plan was written for a power outage and says nothing about ransomware.
  • Field staff, such as home health clinicians, were never told what to do differently.

If three or more of these describe your organization, start with authority, communication and back-entry. Those three sections prevent the most confusion.

Start from a template, or get it built with help

A template works when someone inside the organization has time to fill it in and the authority to make decisions. Outside help makes sense when no one has that time, or when a payer, partner or regulator will review the result.

Your situation Practical starting point
Home health or home care agency writing its first downtime plan Home Health Downtime and Continuity Kit: an editable plan, a 2-page ransomware and outage checklist, and a continuity workbook ($29)
Hospital or hospital system that wants to test its downtime decisions Healthcare Ransomware Tabletop Checklist, or a structured exercise through FSL tabletop exercises
Clinic, FQHC or practice that needs procedures written and approved Cybersecurity Documentation Services, scoped as a fixed project
Organization that needs a wider continuity or COOP plan Business Continuity and COOP Planning
Emergency managers tying downtime into the full preparedness program Emergency Preparedness Consulting

A template or a consultant does not make an organization compliant, secure or approved by any regulator or payer. Either one gives you a structure and a draft. The decisions inside it, and responsibility for meeting your requirements, stay with your leadership.

How should staff document care when the EHR isn’t available?

Use your organization’s approved downtime forms. Record the date, time, patient identifiers and author on every page, keep the originals together, and enter them into the EHR after it’s restored, checking each entry against the paper. Your written downtime procedure should name who does the back-entry and how soon. Home health agencies can start from the editable Downtime Procedures Template ($29), or talk to FSL about writing and testing your procedures.

Next step

Pick one section from the list above and test it this week. Ask the person on shift: if the EHR went down right now, who declares downtime, and where are the forms?

If that answer is unclear and you want help, tell Forward Security Labs what you are working on. Describe your organization type, the systems you rely on, and whether you need procedures written, reviewed or tested. You will get a straight answer on scope and price.

Discuss Your Downtime Needs

Forward Security Labs is the consulting brand of Forward Career Labs LLC. Founder Michael Messina brings 20+ years in emergency healthcare, including EMT, ER tech, paramedic, and EMS supervisor experience, and a B.S. in Cybersecurity.

Sources