I don’t count a downtime plan as ready until staff can use it without the EHR. My starting point: name an owner for each safeguard, test it offline, and keep a record of what worked - and what failed.

I focus on three checks:

  • Protect care: Verify patient identity, access needed clinical information, and keep medications, tests, handoffs, and communication moving.
  • Test the outage: Practice total loss, partial loss, slow performance, and cyber-related failures - including outages that last beyond one shift.
  • Prove recovery: Check restored systems, obtain clinical approval, and reconcile paper records, duplicate orders, and pending results.

The 2025 SAFER Contingency Planning Guide supports this work, but having guidance isn’t the same as being ready. I would track gaps in Censinet RiskOps™ with named owners, deadlines, and retests - not treat the tool as a substitute for practice. <u>A restored login is not the finish line.</u>

EHR Downtime Readiness: From Safeguards to Recovery

EHR Downtime Readiness: From Safeguards to Recovery

Assign Owners and Check Patient-Care Safeguards

Name Responsible Teams and Set Escalation Rules

Assign one executive owner and named backups for clinical care, nursing, pharmacy, laboratory, imaging, HIM, communications, facilities, and IT. State who can activate downtime and what each owner can authorize. Keep an approved, version-controlled plan available offline. Map dependencies - including pharmacy systems, laboratory interfaces, printers, networks, and telecommunications - and set escalation rules for suspected, confirmed, prolonged, and recovered outages.[1][5]

Named owners need tested controls, not just assigned tasks. Test each control offline using the accountability matrix and suggested review schedule below. In the working checklist, use people’s names rather than roles.

Readiness activity Accountable owner Supporting teams Completion evidence Review frequency
Activate downtime response Executive owner IT, nursing, communications, facilities Activation log and observed exercise Annually and after major changes
Maintain patient-care downtime procedures Clinical executive Nursing, pharmacy, laboratory, imaging Approved plan and drill observations Semiannually
Maintain required information access Clinical informatics lead HIM, IT, privacy Access test and exception log Quarterly
Reconcile downtime records HIM lead Clinical departments, IT Sample reconciliation audit After each exercise or outage
Close readiness gaps Quality or risk lead All accountable owners Corrective-action and retest records Monthly until resolved

The next section tests how these owners carry out their assignments.

Check Patient Identification, Information Access, and Medication Tasks

For each control, record its owner, fallback instructions, test date, result, corrective action, and next review date. A completed training roster alone does not establish readiness. Patient identification must work before, during, and after downtime.[2]

Test every control below without the EHR.

Control Owner Evidence Test Frequency Escalation Status
Patient identification and duplicate prevention Nursing or patient-safety lead Temporary-ID instructions and master ID log Use two approved identifiers; demonstrate similar-name, unknown-patient, and wristband-replacement workflows before documenting care, giving medication, collecting specimens, or labeling imaging studies Each drill Unresolved identity → patient-safety lead Record rating
Authorized clinical data access Informatics lead Approved data set, refresh timestamp, access permissions Retrieve needed information; identify stale or missing data and use the approved fallback Quarterly; after access changes Missing critical information → clinical lead Record rating
Medication ordering through reconciliation Pharmacy lead Approved paper or alternate ordering tools, administration records, controlled-substance logs Demonstrate ordering, pharmacist review, dispensing, administration, documentation, and reconciliation; include allergy conflict, duplicate order, stat dose, and a patient arriving with outside medications Each drill Unsafe or unclear order → pharmacist and prescriber Record rating

Set the minimum information staff must be able to access based on clinical risk. Include active medication lists, allergies, code status, major diagnoses, recent laboratory and imaging results, operative history, implanted devices, current care plans, isolation status, and contact information.

Specify where this information is stored, how often it is updated, who may access it, and what staff should do when it is outdated or incomplete. Test paper packets, read-only downtime viewers, approved local caches, and emergency contacts under HIPAA safeguards.[7]

Medication procedures should document who authorized treatment, what was given, dose changes, independent double checks, and communication among pharmacy, nursing, and prescribers.

Check Diagnostics, Care Transitions, and Safety Reporting

Extend downtime checks to lab, imaging, admissions, transfers, discharge, communications, and incident reporting. Verify at least two approved communication paths that do not rely on affected systems. Options include designated phone trees, secure messaging systems, radios, printed contact lists, or an incident command center. Check that staff can confirm receipt and reach external contacts.

Staff must also be able to report medication errors, patient identification events, falls, critical-result delays, and other safety concerns manually, using approved paper or alternate electronic forms.

Control Owner Evidence Test Frequency Escalation Status
Laboratory and imaging work Laboratory and imaging leads Requisitions, specimen labels, pending-work and notification logs Match patient, order, and specimen; record collection time; demonstrate result receipt, critical-result read-back, and follow-up Each drill Unacknowledged critical result → on-call clinical lead Record rating
Admissions and care transitions Nursing/clinical operations lead Admission, transfer, referral, and discharge packets Transfer identifiers, medications, precautions, prescriptions, pending tests, and follow-up responsibility through written and verbal handoffs using read-back or closed-loop communication Each drill Incomplete handoff → sending and receiving leads Record rating
Communications and safety reporting Communications and patient-safety leads Offline contacts, message logs, manual event reports Confirm receipt through alternate channels; route a safety report for review Each drill Failed contact or urgent safety concern → incident command center Record rating
Downtime record tracking HIM lead Controlled record inventory and reconciliation assignments Account for orders, results, medication records, amended reports, and unresolved tasks After each exercise or outage Missing records or unassigned work → HIM and clinical leads Record rating

Next, test whether these owners can activate downtime, support bedside care, and keep services running through an extended outage.

| How to Conduct a Hospital IT Downtime Simulation | JCI Preparedness |

Test Downtime Activation, Care Delivery, and Extended Outages

Assigning owners is only the first step. Test whether they can activate downtime procedures and keep care moving during a full outage. Cover four outage states: total EHR loss, partial orders/results loss, degraded performance, and a cyber incident that disables identity, network, email, printing, or other supporting systems. For each scenario, record which systems are deliberately unavailable, which remain available, and the clinical risk.

Keep each exercise time-limited and approved, with clear start and stop criteria, patient-safety observers, simulated orders and results when needed, and a rapid abort process. Measure performance against locally approved targets, not assumed universal benchmarks.[1][8]

Check Supplies and Backup Information Access

Ask staff to locate and use downtime kits. Check that kits contain current patient-identification forms, medication and treatment documentation, order sheets, laboratory and imaging requisitions, consent forms, handoff tools, and incident-reporting instructions. Also check labels, printer paper, toner, pens, clipboards, batteries, and secure storage containers. Remove obsolete materials.

Test backup information access while the primary network or identity service is unavailable. Measure bedside retrieval time, check how current and complete the data is, identify missing data, and verify permissions for staff on duty. A successful login does not prove staff can use the information at the bedside.[9][11]

Observe Activation and Bedside Care

Run time-limited drills, including one unannounced exercise. Timestamp detection, technical triage, executive notification, downtime declaration, unit notification, and command-center activation. Watch whether bedside work and handoffs continue without prompting.

Include night, weekend, agency, and remote staff. Test internal escalation, after-hours vendor callbacks, and the backup communication channel. Have observers assess how staff explain delays and changed processes to patients and families.[9][10]

Test Readiness Beyond the First Shift

Advance scenarios to 12, 24, or 72 hours, based on local risk. Verify that safe care and recovery readiness hold through handoffs, replenishment, and record handling. Check relief staffing, meal and rest coverage, pharmacy and laboratory capacity, supply replenishment, backed-up manual queues, record transport, and secure storage. Use a four-week planning horizon for clinical and operational downtime processes, but do not treat it as a universal benchmark.[10][12]

Record more than pass/fail results. Activation may succeed while medication verification stalls or staff use obsolete forms. Document observed times, near misses, and unanswered questions. Assign one named owner and a due date to each finding. Close a finding only after retesting the failed step and preserving evidence.[1][6]

Use the following fields to record each scenario’s timing, gaps, and retest owner.

Scenario Activation time Unavailable systems Omitted steps Staff questions Near misses Owner Due date Retest
Total EHR and identity-service loss Timestamp against local targets List affected systems List omissions and delays Record exact questions Describe potential harm Name accountable person Set approved deadline Attach access-test results and observer notes
Partial orders/results outage Timestamp against local targets List affected functions and interfaces List omissions and delays Record exact questions Describe potential harm Name accountable person Set approved deadline Attach request and callback logs
Degraded performance Time recognition and activation List slow or intermittent functions Note delayed fallback decisions Record exact questions Describe potential harm Name accountable person Set approved deadline Attach timing records and workflow observations
Extended cyber-related downtime Time activation and shift transitions List unavailable supporting services List continuity gaps Record exact questions Describe potential harm Name accountable person Set approved deadline Attach staffing, supply, and record-tracking checks

Rehearse EHR Restoration and Record Reconciliation

Recovery needs its own checklist after downtime testing. Readiness isn't complete until restoration has been tested, too.

A restored login is not approval to resume routine care. Treat recovery as a separate checkpoint: validate systems, obtain clinical approval, then reconcile records. Keep temporary restrictions on any system that hasn't passed validation.[1][2]

Approve Restoration and Check System Functions

Assign one restoration authority, backed by documented IT and clinical sign-offs. Use test patients to check restored ordering, results, and discharge workflows. Continue approved downtime workflows until a formal restoration notice arrives through the downtime activation channel.[2][13]

Control clinical risk before validating technical recovery. Use this checklist to prevent an early return to routine workflows.

Recovery task Responsible role Completion evidence Clinical sign-off Escalation path
Verify authentication, role-based access, and network performance IT recovery lead Access-test results and monitoring logs Unit representative confirms required access CIO
Test laboratory, radiology, and pharmacy interfaces Interface lead Sample orders, returned results, and exception report Department leads confirm correct patient and chart Clinical operations lead
Check alerts, timestamps, audit trails, and printing EHR application lead Alert tests, timestamp checks, and audit samples Physician, nurse, and pharmacist validate expected behavior Patient-safety officer
Confirm downtime records are available Health information management lead Patient-level document log Unit leaders check records against the downtime census HIM director
Authorize staged return to electronic workflows Designated restoration authority Timestamped approval, restrictions, and staff notice Clinical executive approves; unit leaders acknowledge Incident commander

Once core functions pass, reconcile the highest-risk records first.

Reconcile High-Risk Records and Pending Tasks

Guides don't reconcile records; trained staff do. Work through a risk-based queue, starting with patient identity and registration, then allergies, medications and administrations, critical results, pending orders, procedures, transfers, and discharges.

Compare paper documentation with the restored chart before entering it. Scanning preserves a document; it does not resolve a clinical discrepancy. Require independent verification of high-risk entries. Send duplicate, conflicting, or incomplete records to a named clinician or pharmacist for review.[13][14][15]

Preserve the original care time, author, and source, and label retrospective entries. Search for existing orders and results before creating new ones. Track each record as entered, verified, clarification required, or unable to reconcile.

HIM and privacy staff should direct storage, scanning, retention, and authorized destruction under applicable requirements. Do not discard paper after re-entry.

Confirm Reconciliation and Assign Unresolved Records

Send a recovery notice that states what's complete, what remains restricted, and where staff should report discrepancies. Review outstanding patient-level items at handoffs and before discharge, transfer, procedures, or medication changes.

Assign every unresolved record a named owner, deadline, and escalation path. During the post-event review, measure high-risk reconciliation time, duplicate entries, unacknowledged critical results, and missed medications. Link each finding to a corrective action and a retest target.[6][15]

Carry unresolved items into the next review cycle.

Conclusion: Keep Readiness Current Through Review and Retesting

After each drill or outage, review the controls tested above and address any gaps. Keep the SAFER Contingency Planning guide on the governance calendar. At each review, confirm that critical tasks still work, authorized staff can access essential patient data without the EHR, and recovery can be validated. Any uncertain answer means the control is not ready.[1]

Review Changes, Training, and Open Risks

Set review dates and drill schedules based on risk. Review controls after changes involving the EHR, interfaces, networks, staffing, roles, service lines, vendors, or cybersecurity. Outages, near misses, and drills should also trigger a review. When failures recur, retest after fixing them - don't wait for the next annual exercise. This keeps downtime, access, and restoration checks current after each change or drill.

Train new and transferred employees before they work independently. Verify their skills with a short scenario or an observed task. Recheck the downtime, information-access, and recovery controls defined above. Confirm that temporary, float, agency, and on-call staff have access, and that supervisors know who can approve emergency workarounds.

Record each review's date, participants, findings, and approval status. For every gap, document the risk, owner, fix, due date, verification method, and remaining risk.

Incomplete safeguards require explicit executive risk acceptance. Document the reason, affected services, interim controls, expiration date, responsible executive, and conditions for reassessment. Acceptance does not make an untested safeguard complete.

Use Censinet RiskOps™ to Track Remediation

Turn each unresolved review finding into a tracked remediation item.

Censinet RiskOps™ can track owners, due dates, evidence, and closure for these gaps. Use it to manage downtime and recovery risks - not to replace clinical readiness tests.

FAQs

Which SAFER safeguards should we prioritize first?

Prioritize SAFER safeguards for life-critical services: emergency care, ICU, surgery, pharmacy, laboratory, and imaging [1][2][3].

Give each unit a downtime playbook with paper order sets and manual medication administration records to support at least 8 hours of care [1]. Map critical clinical workflows to manual backups, and test those procedures in quarterly drills [1][2].

Before returning to electronic systems, use recovery validation checklists that require clinical sign-off [1][4].

How can we test downtime readiness without disrupting care?

Use a tiered approach. Hold quarterly tabletop exercises with clinical, IT, and leadership teams. Walk through outage scenarios, such as ransomware attacks or interface failures, to check decision-making and communication roles - without touching production systems.

Then run restoration and recovery tests in isolated, nonproduction environments. Verify data integrity and application functionality while keeping live electronic protected health information (ePHI) secure and separate from testing.

How do we know our recovery rehearsal was successful?

Your recovery rehearsal succeeds when documented evidence shows the restored system supports safe patient care - not just that it’s back online. Check that patient identities, medications, allergies, orders, results, and audit trails are complete and accurate.

Clinical leaders or department owners must formally sign off before broad use. Document the results with exercise logs, reconciliation reports, and actual restoration times, then use those findings to update procedures.

Related Blog Posts