Why Healthcare Practices' Downtime Plans Fail the Day the System Actually Goes Down

At 7:45 on a Monday morning, the EHR stops responding at a 70-person specialty practice. The front desk cannot pull schedules. Nurses cannot see medication lists. The downtime binder exists, but it sits in a locked office, its contact sheet lists a vendor rep who left two years ago, and the paper forms inside are a version the practice stopped using before its last location opened. The plan was real. It just was not ready.

This is the pattern behind most failed downtime responses. The practice did the planning. It did not do the testing, the ownership, or the upkeep that turn a document into a working procedure.

A Downtime Plan Is Not the Same as a Downtime Capability

A plan is a file. A capability is what a front desk, a clinical team, and a billing office can actually do in the first hour without the system. Most practices have the first and assume they have the second.

The gap is predictable. Plans get written once, usually in the weeks before a HIPAA risk analysis or an insurance renewal. They describe a clean, total outage with a known cause and a short duration. Real outages are messier: a slow EHR that technically works, a single location cut off by a failed internet circuit, a vendor-side incident the practice learns about from its patients, or a ransomware event where nobody can say how long the systems will be unavailable.

A practice with 50 to 200 employees is past the point where one person can improvise. At 100 people across several locations, improvisation produces five different responses and a lot of lost time.

What HIPAA Actually Requires

The Security Rule treats this as a core obligation, not a nice-to-have. Under 45 CFR 164.308(a)(7), a covered entity must have a contingency plan: policies and procedures for responding to an emergency or other occurrence, such as a system failure, that damages systems containing electronic protected health information (ePHI).

The rule breaks that into five pieces:

1. Data backup plan (required). Retrievable exact copies of ePHI.
2. Disaster recovery plan (required). Procedures to restore any loss of data.
3. Emergency mode operation plan (required). Procedures to keep critical business processes running while protecting ePHI during an emergency.
4. Testing and revision procedures (addressable). Periodic testing and revision of the contingency plans.
5. Applications and data criticality analysis (addressable). Deciding which systems matter most, and in what order.

Two points matter here. First, the emergency mode operation plan is the piece that governs what staff do while the system is down, and it is required. Second, the two pieces that make a plan trustworthy, testing and criticality analysis, are the "addressable" ones. Addressable does not mean optional. It means the practice must implement the specification or document why an equivalent alternative is reasonable. In practice, many organizations read "addressable" as "skip," and those are the plans that fail.

Notice also that the rule says to protect ePHI while operating in emergency mode. A paper workaround that leaves patient information on an unsecured clipboard in a hallway solves one problem by creating a compliance problem.

Seven Reasons Downtime Plans Fail on the Day

1. The plan assumes the network is up

The plan lives on a shared drive, in the EHR's own document library, or in a cloud folder. When the system goes down, so does access to the instructions. Guidance on contingency planning consistently points to keeping recovery procedures available in more than one location, independent of local power and network access. A printed copy at each location, plus an offline copy on a device that does not depend on the office network, is the minimum.

2. Nobody owns it

Ask who is responsible for the downtime plan at a growing practice and the answers are usually "IT," "compliance," and "the practice administrator," sometimes in the same meeting. The managed service provider keeps systems running and restores them. It does not decide how a front desk checks in patients on paper, or who tells the providers to switch to paper orders. Without a named owner who also has authority to declare downtime, the first 30 minutes go to deciding who decides.

3. The forms are stale

Paper downtime forms drift out of sync with the live system. A new location, a new intake field, a new consent form, or a changed medication reconciliation workflow all make the printed forms less useful. Federal health IT guidance on EHR contingency planning, including the Safety Assurance Factors for EHR Resilience (SAFER) Contingency Planning guide from the Office of the National Coordinator for Health IT, treats paper alternatives as part of the plan that has to be maintained, not a one-time printout. You can find the full set at HealthIT.gov.

4. The plan covers only one kind of outage

A total outage is the easiest scenario to plan for and the least common. The plans that hold up address at least four situations: total loss of the EHR, loss of one location's connectivity, a slow or partially working system, and a cyber event where the cause and duration are unknown. Each calls for a different response. A slow system is the hardest to call, because staff keep trying to use it and make entries they cannot verify.

5. Nobody has ever run it

A practice that has never rehearsed a downtime does not know which assumption is wrong. Tabletop exercises and short, scheduled drills find the problems cheaply: the printer that cannot print without the network, the paper schedule that was last exported a day ago, the staff member who does not know where the binder is. The American Medical Association's guidance on EHR downtime procedures recommends having a plan, running downtime drills, training staff, and setting up a communication process for triage. A drill that takes 45 minutes on a Tuesday afternoon costs a fraction of one lost clinic day.

6. Recovery is not part of the plan

Surviving the outage is half the work. When systems come back, someone has to re-enter every paper record, reconcile the schedule, confirm what was ordered and what was not, and make sure no charge was lost. Plans that stop at "use paper" leave practices with a backlog nobody planned for, and the errors introduced during re-entry are where patient safety and billing problems appear.

7. Vendors and contacts are out of date

The contact list is the part of the plan that decays fastest. Vendor support lines change, escalation contacts leave, and the cyber insurance carrier's incident hotline sits in a policy document nobody can find.

What an Outage Costs a Practice

Downtime costs are easy to wave away until they are written down for your own organization. Use this pattern, which works at any size:

• Count the visits scheduled per day across all locations.
• Multiply by the average revenue per visit.
• Add the staff hours paid but not productive, and the cost of rescheduling.
• Add the recovery effort: re-entry, reconciliation, and overtime.

A practice scheduling 150 visits a day at an average of $150 per visit has roughly $22,500 in daily visit revenue exposed before payroll and recovery are counted. Substitute your own numbers. The point of the exercise is to make the case for an hour of drilling in the same terms the leadership team uses for everything else.

For scale on the extreme end, Comparitech's analysis of 654 US healthcare ransomware attacks estimated average losses of about $1.9 million per day of downtime. That figure covers healthcare organizations broadly, including hospitals and health systems, so treat it as an upper bound for a practice rather than a forecast. The lesson that transfers is duration: cyber-driven outages tend to last far longer than a failed server, and a plan built for a two-hour interruption will not carry a team through two weeks. The details are in the Comparitech analysis.

A Downtime Plan Checklist That Holds Up

Use this as a working checklist. Each item has an owner and a date, not just a checkmark.

1. Name one owner and one backup. Give them written authority to declare downtime and to call the vendor, the insurer, and the practice leadership.
2. Define the triggers. Write down what counts as downtime: total loss, a single-site loss, degraded performance beyond a set time, or a suspected security incident.
3. Rank the systems. Do the criticality analysis. Scheduling, medication lists, allergy information, and lab and imaging results usually come first. Billing can wait a day.
4. Print the plan at every location. Keep a copy offline, away from the network, and make sure staff know where it is.
5. Maintain the forms. Review the paper forms against the live templates every time the EHR workflow changes, and at minimum once a year.
6. Protect ePHI on paper. Define where downtime paperwork is kept, who handles it, and how it is destroyed or scanned afterward.
7. Write the recovery steps. Cover re-entry, reconciliation, and sign-off before the practice declares the system back to normal.
8. Drill it. Run a tabletop exercise twice a year and a short live drill at each location annually, rotating the scenario.
9. Update the contacts. Review vendor, insurer, and escalation numbers every quarter.

Why This Is a Leadership Problem, Not an IT Ticket

A practice's managed service provider can back up the data and restore the systems. That is the right job for an MSP, and it should do it well. What a provider does not typically own is the operational question of how the clinic keeps seeing patients while the restore happens, or whether leadership has tested that answer.

That is the technology leadership gap in a healthcare setting. Someone has to connect the HIPAA contingency requirements, the recovery times the backup provider can actually deliver, the clinical workflows, and the budget. Elevaire Systems provides that role as fractional IT leadership: we work alongside the practice's existing IT provider to set recovery objectives, assign ownership, schedule the drills, and report the results to leadership in plain terms. The managed provider keeps the lights on. The plan decides what happens when they go out.

Frequently Asked Questions

How often should a healthcare practice test its downtime plan?

Run a tabletop exercise at least twice a year and a short live drill at each location once a year, rotating between total outage, single-site outage, and degraded performance. Also test after any major change, such as a new EHR module, a new location, or a change of IT provider. The HIPAA Security Rule lists testing and revision as an addressable specification, so document what you do and why.

How much does it cost to build a real downtime plan?

Most of the cost is staff time, not software. A first-pass plan for a multi-location practice typically requires a few focused working sessions, a printing and storage budget for the paper kits, and time for the first drills. The larger expense is skipping it. Price your own daily visit revenue and recovery effort using the method above, and compare that number to the hours the plan requires.

Our managed service provider says it handles backups. Is that enough?

Backups are the first of five contingency plan pieces, and a required one. They do not cover how staff work while systems are down, who declares an outage, how patients are checked in, or how records are reconciled afterward. Ask your provider for the recovery time it can actually deliver, then build the operational plan around that number. A good provider will welcome the question.

Does paper downtime documentation create HIPAA problems?

It can if it is handled carelessly. The emergency mode operation requirement says to protect ePHI while operating in emergency mode, so paper records need a defined storage location, restricted access, and a documented process for scanning or destroying them once systems return.

How do we get started if we have nothing written down?

Start with ownership and the system ranking. Name one person responsible, list the five systems the clinic cannot operate without, and write a one-page procedure for the most likely scenario. Print it, put it at each location, and run a 30-minute walkthrough with the front desk and clinical leads. A simple plan that has been tested beats a thorough one that has not.