EHR Downtime Plan & Internet Failover for Medical Practices

Every practice running a cloud or hosted EHR has the same weak spot: the moment the internet drops, the schedule, the charts, e-prescribing, claims and often the phones go with it. A cable cut down the street, a storm, a vendor's bad update or a ransomware attack at a company you've never heard of can all produce the same result: a waiting room filling up and a front desk that can't check anyone in.

The good news is that this is one of the most solvable problems in practice IT. A backup internet line that switches over automatically handles the most common outage. Battery backup keeps it running through power blips. And a short, practiced downtime plan covers the rarer cases where the EHR itself is down, so staff know exactly what to do instead of improvising.

This guide walks through all of it for medical and dental practices: what HIPAA requires, the kinds of outages to plan for, how much downtime actually costs, failover options (cellular, dual internet providers, SD-WAN), UPS sizing, downtime reports, paper workflows, phone failover, testing, and a fill-in downtime plan template you can adapt. It's the companion to our medical office IT guide and dental office IT guide.

What is an EHR downtime plan, and does HIPAA require one?

An EHR downtime plan is a written procedure for safely seeing patients when your electronic health record is unavailable, and for catching up afterward. HIPAA requires the core of it: the Security Rule's contingency plan standard makes a data backup plan, a disaster recovery plan, and an emergency mode operation plan mandatory for every covered practice.

The contingency plan standard at 45 CFR 164.308(a)(7) requires you to "establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information" (Cornell LII). It has five parts:

"Addressable" doesn't mean optional. It means you must implement the specification if it's reasonable and appropriate, or document why not and what you do instead. For a downtime plan, testing is plainly reasonable.

Beyond HIPAA, the federal SAFER Guides (Safety Assurance Factors for EHR Resilience), updated in 2025 by HHS's health IT office (ASTP/ONC), include a dedicated Contingency Planning guide with recommended practices for "planned or unplanned EHR unavailability" (SAFER Guides). We reference its recommendations throughout this article; it's written for organizations of all sizes and worth a read.

What kinds of outages should a practice plan for?

Plan for six kinds of outage, because each needs a different response: your internet line, power, your local network, the EHR vendor, a cyberattack, and a third party you depend on. Internet outages are the most common and the easiest to fix; ransomware is the rarest and the hardest.

Two recent real-world examples show why third parties belong on this list:

• Clearinghouse attack. In late February 2024, Change Healthcare, a major claims clearinghouse and a unit of UnitedHealth Group, was hit by a cyberattack. HHS acknowledged the impact on health care operations across the country, and CMS took steps including expediting enrollment for providers that needed to change clearinghouses (HHS, March 2024). Nothing was wrong inside those practices' offices, yet claims stopped flowing.
• Faulty software update. In July 2024, a defective update from security vendor CrowdStrike affected an estimated 8.5 million Windows devices worldwide, according to Microsoft (Microsoft, July 2024). Affected computers failed to start until fixed, one by one.

You can't prevent outages like these. You can decide in advance how you'll keep seeing patients during them.

How much does EHR downtime cost a practice?

Downtime costs more than most practices expect, because it combines lost visits, staff paid to wait, after-hours catch-up, and patient goodwill. Calculate it for your own practice before deciding what to spend on prevention.

A simple way to estimate the cost of one hour of downtime:

1. Lost or delayed production: visits per hour you'd have to reschedule × average revenue per visit.
2. Idle staff cost: number of staff × average hourly cost (wages plus benefits).
3. Catch-up cost: overtime hours to back-enter paper records and resubmit claims × hourly cost.
4. Harder-to-count costs: patients who leave and don't return, delayed claims, stress on staff.

For example, a practice that sees 8 patients an hour, with 10 staff, can lose hundreds to thousands of dollars per hour before counting catch-up time. Our free downtime cost calculator runs this math with your own numbers. Most practices find that a single half-day outage costs more than a year of backup internet service, which makes the decision easy.

How do you keep the internet up? Your failover options

The most effective single step is adding a second internet connection from a different provider, connected to a firewall that switches over automatically. For most small practices, that second connection is a cellular (LTE or 5G) router; where possible, a second wired provider on a different physical path adds capacity.

Failover means automatically switching to a backup when the primary fails. Dual WAN means a firewall or router with two internet connections (WAN stands for wide area network, the internet side of your network).

What the SAFER Guide recommends

The 2025 SAFER Contingency Planning guide recommends that organizations maintain a redundant path to the internet, ideally two different cables in different trenches, or a wireless connection from a different provider. It specifically recommends that "smaller ambulatory clinics have at least a cellphone-based, wireless Internet access point that is capable of running a cloud-hosted EHR as a backup to their main cable-based Internet connection" (SAFER Guide 2, 2025).

Comparing backup internet options

Why physical diversity matters

Two internet providers that both arrive on the same telephone pole or through the same underground conduit can both go down when a truck hits that pole or a backhoe digs that trench. Ask each provider how their line reaches your building. Cellular avoids the problem entirely because nothing physical connects it to the street, which is one reason it's such a good backup for small offices.

How to set up cellular failover properly

1. Test signal before you buy. Walk the office with phones on two or three carriers. Put the cellular router where the signal is strongest, often near a window or high on a wall in the network closet, and use an external antenna if needed.
2. Choose a different carrier from your primary internet provider, so a single company's outage doesn't take down both.
3. Get a business data plan with enough data for a full day of operations. Ask what happens when you hit any cap: slowdown, overage charges, or cutoff.
4. Connect it to a dual-WAN firewall, not just plugged into a switch. The firewall checks the primary line continuously (for example, by testing whether it can reach several internet addresses) and moves traffic within seconds when it fails.
5. Prioritize traffic. On a smaller backup line, set the firewall so the EHR, phones and card processing get priority, and guest Wi-Fi gets little or nothing.
6. Turn on alerts, so your IT provider knows when you've failed over and can open a ticket with the primary provider. Otherwise you can run on cellular for days without noticing, until the data bill arrives.
7. Put the router on battery backup along with the firewall and switch.
8. Test it by unplugging the primary line (see the testing section).

Real-world result

This is exactly what we did for one of our dental clients. Their scheduling, imaging, insurance claims and patient records all depended on the internet, and when the connection dropped, the front desk stopped. After we added automatic cellular failover that switches over during an outage "with no one touching anything," the practice has had zero downtime during internet outages, with front-desk work and patient care continuing uninterrupted. Read the full dental practice case study.

What is SD-WAN, and do you need it?

SD-WAN (software-defined wide area network) is technology that manages multiple internet connections intelligently, measuring each link's quality and steering each type of traffic, like voice calls or EHR sessions, over the best one in real time. Most single-location small practices don't need it; a good dual-WAN firewall does the job. It becomes worthwhile for multi-site practices or offices with heavy voice and video.

What SD-WAN adds beyond basic failover:

• Quality-based steering. Instead of only switching when a line is completely down, SD-WAN notices when a line is degraded (high delay, packet loss, jitter) and moves sensitive traffic, such as phone calls, to the better line.
• Using both lines at once, rather than leaving the backup idle.
• Centralized management across several offices, with consistent security policies.
• Smoother failover for some traffic types, depending on the product and whether your providers support it.

Questions to decide whether it's worth it:

1. Do you have more than one location that shares systems?
2. Do your phones suffer from choppy audio even when the internet is "up"?
3. Do you run telehealth video at scale?
4. Is your primary line frequently degraded rather than completely down?

If the answer to all four is no, invest in a solid dual-WAN firewall and a good cellular backup instead.

How do you keep the network running through power outages?

Put every piece of equipment the internet depends on, including the modem, firewall, network switch, cellular router and Wi-Fi, on a UPS (uninterruptible power supply), a battery unit that keeps devices running when power fails. For outages longer than the batteries last, decide in advance whether you'll run a generator, relocate, or close.

A failover internet line does nothing if the box it plugs into loses power. This is the most common gap we see: a practice pays for cellular backup, the power flickers, and the firewall reboots anyway.

What goes on battery backup

1. Internet modem(s) and cellular router
2. Firewall
3. Network switch, especially if it powers desk phones and Wi-Fi access points through the network cable (PoE)
4. Server or network storage, if you have one, with automatic clean shutdown when batteries run low
5. At least one front-desk computer and monitor, so check-in can continue on cloud software
6. One printer, if you need to print downtime reports during an outage (laser printers draw a lot of power; size accordingly or use a small inkjet)

Sizing a UPS in plain terms

• Add up the wattage of everything plugged into it (from labels or specifications), then add headroom.
• Check the runtime chart for that UPS model at your load. A UPS that runs one switch for an hour may run a full closet for ten minutes.
• Aim for meaningful runtime. Enough to ride through the short outages common during Florida summer storms without anything rebooting, and ideally 15–30 minutes or more for network gear. The SAFER Guide describes a UPS capable of maintaining the EHR "for at least 10 minutes" and recommends regular testing.
• Replace batteries every few years, as the manufacturer recommends. UPS batteries wear out quietly; many units show a warning light no one notices.
• Use network-connected UPS units so your IT provider gets alerts for power events and battery failures.

Longer outages

For outages measured in hours, batteries alone won't do it. Options:

• A generator (portable or standby) with a safe transfer switch installed by an electrician. Larger organizations use these; the SAFER Guide describes generator support with fuel for extended outages.
• Relocation: an agreement to work from a sister office or another site, with cloud EHR access.
• Planned closure: rescheduling patients with a phone tree and a message on your phone system.

During hurricane season, plan this before a storm is in the forecast. Our hurricane preparedness guide for Florida businesses covers the full storm checklist.

How do you access patient information when the EHR is down?

Keep a recent, read-only copy of the information you need to run the day: tomorrow's schedule, patient demographics and contact details, problem lists, medication and allergy lists for scheduled patients, and recent results. Many EHRs can produce these "downtime reports" automatically; your job is to make sure they're generated, stored securely and reachable without the EHR.

What the SAFER Guide recommends

The SAFER Contingency Planning guide recommends a "read-only" backup EHR system that's tested regularly and can print, connected to battery or generator power (SAFER Guide 2, 2025). Large hospitals do this with dedicated systems. A small practice can achieve the same goal more simply.

Practical options for small practices

1. Vendor downtime reports. Ask your EHR vendor whether it offers scheduled downtime reports or a "business continuity" feature. Some deliver encrypted reports to a designated computer every few hours; others let you run reports on demand.
2. End-of-day printed schedule. At minimum, print the next day's schedule with patient names, phone numbers, appointment types and providers. Store it in a locked drawer and shred it the following day.
3. A designated downtime laptop. An encrypted, managed laptop on battery that receives the latest downtime reports and can print over USB if the network is down.
4. Read-only exports. If your EHR supports it, a scheduled, encrypted export of key patient summaries for upcoming appointments.

Security rules for downtime information

Downtime reports are patient information, so:

• Encrypt any device that stores them.
• Restrict access to the people who need it.
• Keep paper copies locked and shred them on a schedule.
• Document the process in your risk analysis and policies.

What to include in downtime reports

What paper workflows do you need during EHR downtime?

Keep a downtime kit with enough paper forms for at least one full clinic day, a clear process for who fills in what, and a back-entry plan so everything written on paper ends up in the EHR afterward. The SAFER Guide recommends enough paper forms to care for patients for at least eight hours.

The downtime kit

Store it in a labeled box or binder at the front desk and in clinical areas:

1. The downtime plan itself (one page of "first steps," plus the full plan)
2. The IT and vendor contact sheet
3. Patient registration and sign-in forms
4. Consent and HIPAA acknowledgment forms
5. Encounter/visit note forms or progress note templates
6. Vitals flow sheets
7. Order forms for labs and imaging
8. Paper prescription pads (secure, numbered) and a prescription log
9. Superbill/charge capture forms
10. Payment receipts and a manual card-processing or "collect later" procedure
11. A downtime log to record what was done on paper and needs back-entry
12. Pens, clipboards, and labeled folders for completed forms

Prescriptions during downtime

Florida's e-prescribing law has exceptions, and the Florida Board of Pharmacy's guidance notes that written prescriptions remain acceptable during temporary technological or electrical failures (Florida Board of Pharmacy). Controlled substances carry additional federal rules, and the CMS EPCS program counts Medicare Part D controlled substance e-prescribing toward a 70% compliance threshold, with exceptions including declared disasters (CMS). Practical steps:

• Keep secure prescription pads locked up, with a log of numbers issued.
• Record each paper prescription in the downtime log.
• Enter it into the EHR as a historical or "printed" prescription afterward, so the medication list is complete.
• Check with your EHR vendor and pharmacy partners about any additional steps for controlled substances.

The back-entry process

Paper only helps if the information gets back into the chart. The SAFER Guide calls for a process to ensure information recorded on paper during downtime is entered and reconciled into the EHR after it's restored.

1. Assign owners: who enters demographics, who enters clinical notes (usually the provider or their scribe), who enters charges.
2. Prioritize: medications, allergies, orders and results first; billing next.
3. Scan the paper into each patient's chart as a record of what happened during downtime.
4. Reconcile: check that every patient on the paper sign-in sheet has a completed encounter in the EHR.
5. Set a deadline: for example, all downtime documentation entered within two business days.

How do phones keep working when the internet or power goes down?

Set up your cloud phone system to forward calls automatically to cell phones or another location when your office phones go offline, and record an emergency greeting you can switch on in seconds. Then make sure staff can reach each other without the office systems.

Phone failover settings

1. Automatic failover routing. Most cloud phone systems can detect when your desk phones are unreachable and send calls to designated cell phones, a sister office, or an answering service. Set this up now, not during an outage.
2. Emergency greeting. Pre-record a message like: "We're experiencing a temporary system issue. We're still seeing patients. Please stay on the line or leave a message and we'll call you back today." Know how to switch it on from a phone or web portal.
3. Mobile app. Many cloud phone systems have a smartphone app that lets staff answer office lines on their own phones over cellular data. Configure it for key staff before you need it.
4. Power for desk phones. Phones powered by the network switch die with the switch. The UPS on the switch keeps them alive through short outages.
5. 911. Make sure staff know that if desk phones are down, they should use a cell phone for 911. FCC rules require multi-line phone systems to allow direct 911 dialing and provide location information to the extent technically feasible (FCC, 2025); during a phone outage, a cell phone is your path.

Staff communication independent of IT

The SAFER Guide recommends that your communication strategy for downtime be "independent of the computing infrastructure that supports the EHR." In a small practice, that means:

• A group text or phone tree with every staff member's cell number, kept on paper and in phones.
• Not relying on Teams or email alone to tell people what's happening if Microsoft 365 or your internet is the thing that's down.
• A clear "downtime declared" message so everyone switches to paper at the same time.

What's different when the outage is ransomware?

Ransomware is a downtime event, a security incident and possibly a HIPAA breach at the same time. Your first priority shifts from "keep working" to "stop the spread and preserve evidence," so the downtime plan needs a separate branch for it.

HHS considers ransomware on your systems a security incident, and when it encrypts patient data, a breach is presumed unless the practice can demonstrate a low probability that the information was compromised (HHS ransomware fact sheet).

What changes in the plan:

1. Disconnect, don't power off. Unplug network cables or disconnect Wi-Fi on affected machines, and call your IT provider immediately. Turning computers off can destroy information investigators need.
2. Don't use affected systems for anything, including "just checking" email.
3. Switch to paper and phones on the downtime plan, using devices you know are clean (often personal cell phones for calls only).
4. Activate your incident response plan: IT provider, cyber insurance carrier (often before hiring outside help, per your policy), legal counsel.
5. Restore from clean, immutable backups only after the infection is contained.
6. Assess breach notification duties with counsel. Our HIPAA breach response plan walks through the steps.

Prevention is still the best plan: multi-factor sign-in, endpoint detection and response, patching, email filtering and staff training. The SAFER Guide itself recommends training users on ransomware prevention, including how to spot malicious emails and fraudulent callers asking for login information. HHS's 405(d) program publishes free, practical guidance for small healthcare organizations (405(d) HICP). See our ransomware protection guide for the full playbook.

How do you test a downtime plan?

Test three ways: unplug the primary internet at least quarterly to prove failover works, run a tabletop walk-through with key staff at least twice a year, and run a real downtime drill with paper workflows at least once a year. The SAFER Guide recommends unannounced downtime drills at least annually.

Test 1: The failover pull test (quarterly, 15 minutes)

1. Pick a quiet time and tell the front desk.
2. Unplug the primary internet line at the modem.
3. Check: Does the EHR keep working? Phones? Card processing? E-prescribing? Imaging (for dental)?
4. Check that your IT provider received the failover alert.
5. Plug the primary line back in and confirm traffic returns to it.
6. Write down the results and anything that didn't work.

Test 2: The power test (twice a year)

1. With your IT provider, simulate a power cut to the network closet (switch off the UPS's input, not its output).
2. Confirm that everything stays up on battery and the UPS reports runtime remaining.
3. Note the actual runtime estimate at that load.
4. Check UPS self-test logs and battery health.

Test 3: The tabletop exercise (twice a year, 30–45 minutes)

Sit down with the office manager, a lead clinician, the front desk lead and your IT provider. Walk through a scenario out loud: "It's 9:15 Tuesday. The EHR vendor's status page says they're down, estimated two hours. What do we do?" Step through the plan and note gaps: missing forms, outdated phone numbers, unclear decisions.

Test 4: The live drill (yearly, ideally unannounced)

For one hour, run the clinic as if the EHR were down: use downtime reports, paper forms, the prescription log and phone failover, then complete the back-entry process. It's disruptive, which is exactly why it's valuable. Staff turnover means the person who knew the plan last year may not be here this year.

After every test or real outage

• Update the plan with what you learned.
• Restock the downtime kit.
• Refresh contact sheets.
• Record the test for your HIPAA documentation (testing and revision is part of the contingency plan standard).

Downtime plan template

Copy this template, fill in the blanks, print it, and keep copies at the front desk, in clinical areas and offsite. Keep it short enough that someone can follow it under pressure.

[Practice name] EHR and Internet Downtime Plan Last updated: [date] · Next review: [date] · Plan owner: [name]

1. Who can declare downtime [Office manager] or, if unavailable, [lead clinician]. Declare downtime when the EHR has been unavailable for more than [15] minutes or immediately for a suspected cyberattack.

2. First five minutes

1. Check whether it's just one computer, our office, or the vendor (vendor status page: [URL]; call IT: [number]).
2. If our internet is down, confirm backup internet took over (IT will receive an alert).
3. If it's a suspected cyberattack: disconnect affected computers from the network, do not power them off, call IT at [number], and follow Section 8.
4. Send the downtime message to all staff by [group text / phone tree].
5. Switch the phone system to the emergency greeting if needed ([instructions]).

3. Where to find patient information Downtime reports: [location / downtime laptop / locked drawer]. Updated every [X] hours by [system]. Printed next-day schedule: [location].

4. Paper workflows Downtime kit location: [location]. Front desk uses: [forms]. Clinical staff use: [forms]. Providers use: [forms]. All paper goes into the "Downtime – to be entered" folder at [location].

5. Prescriptions Secure prescription pads: [location, key holder]. Log every paper prescription in the downtime log. Controlled substances: [practice procedure].

6. Phones Failover routes calls to: [numbers]. Mobile phone app enabled for: [names]. Emergency greeting switch: [instructions]. For 911, use a cell phone if desk phones are down.

7. Payments and claims Card processing during outage: [procedure]. Claims: hold until restored; alternate clearinghouse contact: [contact].

8. Cyberattack branch Do not use affected systems. Call IT [number], cyber insurance [policy number, hotline], legal counsel [contact]. Follow the incident response plan at [location].

9. Recovery and back-entry When systems return: [who] confirms systems are working; [who] enters demographics; providers enter clinical documentation; [who] enters charges. All downtime documentation entered within [2] business days. Scan paper into charts.

10. Contacts IT provider: [name, number, after-hours alert line]. EHR vendor support: [number, account #]. Internet provider: [number, account #]. Cellular backup carrier: [number]. Phone provider: [number]. Clearinghouse: [number]. Building/landlord: [number]. Power company: [number].

11. Testing schedule Failover pull test: quarterly. Power test: twice yearly. Tabletop: twice yearly. Live drill: yearly. Results recorded in [location].

Downtime planning mistakes we see most often

1. Backup internet without battery backup, so a power blip takes down the firewall and both connections with it.
2. Cellular backup on the same carrier as the primary, or a router placed where the signal is weakest.
3. No alerts on failover, so the office runs on cellular for days, hits a data cap, and slows to a crawl.
4. Downtime reports that were never turned on, or stored on the server that's also down.
5. Paper forms that are years out of date, or nobody knows where the box is.
6. Phone failover not configured, so patients hear endless ringing.
7. The plan lives only in SharePoint, which you can't reach when the internet or Microsoft 365 is down.
8. No back-entry process, so downtime notes never make it into the chart.
9. Never testing, so the first test is a real emergency.
10. No branch for ransomware, so staff keep using infected computers "to finish the day."

Two example scenarios

These are illustrative examples based on common situations, not specific clients.

Example 1: Fiber cut on a Wednesday morning (medical practice)

At 10:20, a construction crew cuts the fiber line serving a four-provider internal medicine practice in Daytona Beach. Within seconds, the firewall moves traffic to the cellular backup. The EHR session pauses briefly and reconnects; one phone call in progress drops and the patient calls back. The IT provider receives a failover alert, opens a ticket with the fiber provider, and messages the office manager. Guest Wi-Fi is automatically limited on the backup line, so clinical traffic stays fast. The fiber is repaired at 4:45 p.m. and traffic moves back automatically. Patients never notice.

Example 2: The EHR vendor is down (dental practice)

At 8:05 on a Monday, a dental practice's cloud practice management software shows an error. The front desk checks the vendor's status page: a vendor-wide outage, estimated two hours. The office manager declares downtime and sends the group text. The front desk uses the next-day schedule printed Friday, plus downtime reports on the encrypted downtime laptop. Hygienists capture X-rays in the local imaging software (which still works), chart on paper perio forms, and note treatment on paper. Checkout writes receipts and collects copays by card terminal. The vendor restores service at 10:40. The team enters treatment notes and charges by end of day, scans the paper, and adds one improvement to the plan: print two days of schedules on Fridays instead of one.

Questions to ask your EHR vendor and IT provider

For your EHR vendor

1. Do you offer downtime reports or a read-only continuity option? How do we turn it on?
2. Where do you post outage notices, and how quickly?
3. What's your uptime commitment and recovery time objective?
4. How should we handle e-prescribing, including controlled substances, during your outage?
5. How do we back-enter documentation and prescriptions written during downtime?

For your IT provider

1. Is our backup internet automatic, and how will we know we've failed over?
2. What's on battery backup, and how long will it last at our load?
3. When was failover last tested, and what were the results?
4. Do you monitor around the clock, and what happens when an alert fires after hours? (Ask whether that means staffed 24/7 support or automated monitoring with alerts.)
5. What's our recovery plan if the firewall or switch fails outright?
6. What's our ransomware response procedure?

If you're evaluating providers, our guide to choosing a managed IT provider has more questions, and our backup and disaster recovery guide covers the data side of continuity.

The bottom line

You can't prevent every outage, but you can make most of them invisible to patients. Start with the two highest-value steps: an automatic backup internet line and battery backup for the equipment it depends on. Then add the downtime plan: reports you can reach without the EHR, a stocked paper kit, a back-entry process, phone failover, and a separate branch for ransomware. Test it on a schedule, update it after every real outage, and keep a printed copy where people can find it.

That's what a HIPAA contingency plan looks like when it actually works.

If you'd like help building yours, from choosing the right failover line to running your first downtime drill, book a free 20-minute call. We work with medical and dental practices across Volusia and Flagler counties and remotely throughout the US. See how we support healthcare practices and our IT services.