EHR Downtime: An Administrative Continuity Checklist

EHR downtime is not only an IT problem. Calls, arrivals, and records continue while the usual source of truth is unavailable. A continuity plan gives administrative staff a narrow, rehearsed way to capture and route essential information while technical and clinical leaders control recovery and care decisions.

The plan must fit local systems, risk analysis, law, contracts, and clinical operations. HHS explains in its HIPAA Security Rule summary that regulated entities need procedures for emergencies affecting systems with electronic protected health information, including backup, restoration, and critical processes in emergency mode. Qualified personnel determine local application.

Before downtime: build a controlled packet

Create a version-controlled packet in approved locations. Include activation authority, incident contacts, approved channels, paper registration and message forms, label procedures, minimum scheduling fields, clinical forms selected by clinical leadership, and reconciliation steps. Every page needs a name, version, page number, and downtime identifier field.

Keep only the minimum PHI needed. The privacy lead should approve storage, printing, access, transport, and destruction. Do not keep packet photos, exports, screenshots, or patient lists on personal phones, personal email, consumer drives, or unapproved messaging apps.

Maintain an offline contact list that contains business contact information, not a broad patient export. Test access to locked paper supplies and approved emergency tools during drills. The role-based HIPAA staffing guide can help define who receives each component.

Before downtime: assign command and handoff roles

Name an incident lead, IT or vendor lead, clinical lead, administrative lead, and privacy or security lead. Assign backups and one status channel. The incident lead declares activation and recovery; each functional lead controls decisions in that domain.

Administrative staff may identify the caller, record exact words, apply an approved nonclinical label, and contact the clinical recipient. They must not judge urgency, advise medication changes, interpret results, or independently redirect care. Staff may read an approved emergency script while alerting the clinical lead under policy.

Define what happens if phones, internet, power, or the EHR fail separately. One incident can affect only a single dependency. The ONC SAFER Contingency Planning guide emphasizes collaborative planning with clinicians and staff for substitute workflows during downtime. Completing that guide alone does not establish HIPAA compliance.

During downtime: activate secure minimum workflows

At activation, record the time, scope, incident lead, affected functions, next update, and packet version. Issue sequential downtime identifiers. Verify identity under the approved process and place the identifier on every page. Use the temporary process when identity is unresolved.

Use staffed work areas, face-down forms, locked bins, controlled printers, and documented transfers. Avoid hallway piles and open fax trays. Record who receives each batch and when. Privacy decisions, breach analysis, and notifications belong to qualified practice personnel.

Do not create shadow spreadsheets unless the plan authorizes a secured tool. A new file can become an unmanaged second record and produce duplicates.

During downtime: keep calls moving without triage

The call-routing sheet needs caller name, approved identifiers, callback, exact request, time, destination, attempts, and acknowledgment. Operational labels such as appointment, refill, result, referral, records, and billing route work; they do not express clinical urgency.

The clinical lead defines immediate and timed queues. Administrative staff follow that matrix and record the handoff. If symptoms arise during an administrative call, transfer the exact message through the clinical pathway.

A related patient portal inbox workflow can inform ownership, but downtime forms should not be backfilled casually into an unavailable portal. A virtual medical receptionist can support approved call capture and routing only through practice-controlled systems and supervision.

During downtime: control scheduling and paper forms

Maintain one authoritative downtime schedule per location. Record created, changed, canceled, arrived, and no-show statuses with time and initials. Front desk, phone, and remote teams must not keep competing lists. Use the backup chain if the schedule owner is unavailable.

Clinical leadership decides which visits proceed, pause, or move based on access to information and patient-care needs. Administrative staff execute those decisions, communicate approved language, and record attempts. They should not cancel a clinically sensitive visit based only on their view of the outage.

Number multipage forms and correct paper under records policy without obscuring the original entry. At shift change, count unresolved forms and obtain acknowledgment. For remote-work controls, see how to manage virtual medical staff day to day.

After downtime: reconcile before normal cleanup

The incident lead declares when recovery entry begins. Preserve the log and divide forms into controlled batches. Authorized staff find the correct patient and encounter, enter or scan under policy, preserve relevant times, and mark each item entered, reviewed, or held. Clinical content receives designated clinical review.

Prevent duplicates with a single reconciliation tracker. Before creating a new patient, appointment, order, message, or encounter, search using approved identifiers and check whether another team has already entered it. Never merge charts, resolve conflicting orders, or discard apparent duplicates without the authorization required by policy. Record the rationale and reviewer for every exception.

Reconcile appointments, messages, registrations, referrals, prescription requests, result communications, faxes, payments, and replayed interfaces. Dispose of paper under policy only after designated review confirms completion.

Run a hypothetical tabletop implementation

Consider a hypothetical implementation, not measured results. A two-location practice simulates a 90-minute EHR outage while phones remain available. The practice manager declares the drill, the IT lead posts status updates, the nurse lead receives all symptom-bearing messages, and reception staff issue sequential IDs and maintain one paper schedule per site. No real patient information is used in the exercise.

Two reconcilers process numbered batches while a reviewer plants a duplicate appointment and unmatched identifier. The team assesses search and exception steps, then updates training. This hypothetical rehearsal promises no recovery or compliance outcome.

Measure continuity and review authoritative sources

Measure declaration and packet times, forms missing an ID, unacknowledged clinical handoffs, unresolved-item age, duplicate records, and final review time. Track by incident type and location, and interpret results against scope and baseline.

Sources and review notes: the HHS Security Rule summary supports contingency planning for backup, restoration, and critical processes in emergency mode. The ONC SAFER guide supports multidisciplinary substitute-workflow planning and self-assessment. Both were reviewed for this article on September 18, 2026. The practice’s current risk analysis, counsel, contracts, vendor procedures, clinical policy, and applicable law control implementation.