At 9:07 on a Tuesday, the schedule is full and every EHR screen is blank. A useful downtime procedure tells a small practice what happens in the next ten minutes, which care can continue, where approved forms live, and who reconciles every record after recovery. The vendor’s status page is only one line in that plan.
Takeaways:
- Name an operational lead and a clinical decision owner before the outage.
- Keep approved contacts, forms, and the downtime procedure reachable outside the failed system.
- Patient identity, medication work, orders, results, and documentation need separate fallback decisions.
- Recovery is not complete until downtime work is reconciled and checked.
The first ten minutes
Do not begin with a root-cause debate. Confirm the boundary. Can nobody sign in, or only one user? Is the EHR slow, read-only, or absent? Do phones, internet, printers, e-prescribing, lab, imaging, and the patient portal share the failure?
The downtime lead records the start time, affected services, person who confirmed the problem, vendor case number, staff update channel, and next update time. The clinical owner decides whether scheduled services continue normally, continue under an approved reduced workflow, pause, or redirect.
The 2025 SAFER Contingency Planning Guide addresses planned and unplanned EHR unavailability. ASTP/ONC’s Health IT Playbook points practices toward a paper-based route for documentation, medications, tests, and procedures when the EHR is unavailable. Those sources are a starting point. The clinic still needs local roles and approved procedures.
The one-page command card
Keep this card with the current downtime packet, not inside the EHR.
| Time | Owner | Action | Evidence to retain |
|---|---|---|---|
| 0 to 10 minutes | Downtime lead | Confirm scope, open vendor case, announce status and next update | Event start, boundary, contacts, case number |
| 0 to 15 minutes | Clinical owner | Set continue, modify, pause, or redirect decisions by service | Decision, reason, affected appointments |
| 10 to 30 minutes | Front desk lead | Move to approved schedule and identity procedure | Patient list source, labels, exceptions |
| 10 to 30 minutes | Clinical lead | Issue current forms and medication, order, result, and note instructions | Form versions, staff acknowledgment |
| Every stated interval | Downtime lead | Update staff even when status is unchanged | Message time and content |
| On recovery signal | Technical and clinical owners | Test before declaring normal operation | Test patient, access, order, result, note, audit evidence |
| After return | Reconciliation owner | Account for every downtime record and open task | Reconciliation ledger and exception list |
The card is not the whole policy. It is the page people can use while phones ring.
Identity comes before blank paper
A stack of forms is dangerous if staff cannot attach the right person to each page. Define how registration checks identity when normal lookup is unavailable, how temporary identifiers work, which labels are permitted, and who resolves a duplicate after recovery. Put identifiers on every approved page before clinical information is added.
Keep an exception list. Misspelled names, newborns, unknown patients, similar names, and people seen at another location need a deliberate route. Do not let each desk invent one.
Five workflows need separate rules
Clinical documentation
Use current, approved forms. Record author, date, time, patient identity, assessment, plan, orders, and handoff information required by the practice. Secure completed pages and name the person who collects them. “Scan later” is not a custody plan.
Medication work
The clinical owner defines what can continue when medication history, interaction checks, or electronic transmission are unavailable. State the alternate order route, read-back rule where applicable, pharmacy communication path, and recovery reconciliation. This is not a place for a blog to invent clinical instructions.
Orders and results
Track each order outside the unavailable queue. Record destination, time, priority, requester, expected result route, person responsible for follow-up, and whether the result arrived. After recovery, the owner matches every request to a result or an open exception.
Patient communication
Decide who tells patients about delays, rescheduling, reduced services, portal unavailability, or changed follow-up. Use an approved channel. Do not place PHI in an ordinary messaging tool because the normal system is down.
Billing and referrals
Capture enough information to restart work without rebuilding the visit from memory. Keep authorization, referral, charge, and document tasks on the same event ledger. Some items can wait. Mark them rather than letting them vanish.
Recovery is a controlled cutover
An EHR login screen returning does not end downtime. Test a small route first: patient lookup, role access, documentation, an order or equivalent workflow, a result route, and the audit record the practice expects. Confirm what period or function remains incomplete.
Then reconcile. For every patient seen during downtime, list the paper or alternate records created, orders placed, results received or pending, medication actions, messages, referrals, billing items, and follow-up tasks. Name who enters or scans each item, who checks it, and how duplicate or conflicting entries are resolved.
The HHS OIG contingency-plan report describes the HIPAA contingency-plan elements it reviewed: data backup, disaster recovery, emergency-mode operations, and testing and revision procedures. The regulation itself appears at 45 CFR 164.308(a)(7). A practice should map its local plan with qualified privacy, security, clinical, and legal owners rather than copying a hospital policy.
Run a 25-minute tabletop
Pick a Thursday morning with twelve booked patients. Assume the EHR is unavailable but electricity, phones, and the local network still work. Give staff five minutes to find the current plan, contact list, schedule route, and approved forms.
Walk one ordinary visit and one exception. The exception might be two patients with similar names, an outside result expected today, or a prescription request that cannot follow its normal route. Stop when somebody says, “We would probably.” That sentence is the gap to assign.
Finish with recovery. Hand the team three paper records, one pending result, and one duplicate-identity question. Ask them to reconcile the set. Record missing documents, stale contacts, unclear authority, inaccessible files, and work without an owner. Set dates.
We think the recovery exercise is the part most small practices skip. It is also where a safe-looking paper process can create a second mess inside the restored EHR.
Patient Square does not replace the plan
Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot: an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot.
A practice can use the bundled Patient Square record system or keep its current EHR and use Practice Copilot alongside it. Either path needs local downtime ownership. Patient Square does not claim that an AI draft replaces approved downtime documentation, medication, order, result, identity, or recovery procedures.
The EHR implementation guide covers planned rollout, while the EHR data migration guide covers cutover evidence. review the current Practice Copilot scope, then put the accepted result in the practice’s own procedure.