What Recent Healthcare Disruptions Teach Us About Downtime Preparedness

Why Healthcare Downtime Preparedness Matters

In daily healthcare operations, many disruptions begin with a localized power failure, an electronic health record update that does not go as planned, a network interruption or an integration issue. Emergency generators, redundant systems and established paper documentation procedures can help staff remain productive and continue treating patients while normal operations are restored.

Major healthcare disruptions, however, rarely affect only one workflow. A single incident can interrupt patient registration, clinical documentation, prescription processing, claims, communications, care coordination and access to patient information.

Is Your Healthcare Downtime Plan Ready?

Emergency management, clinical, health information management, IT, pharmacy, revenue cycle and facilities teams should periodically review how their organization would continue operating during both digital and physical disruptions.

A plan is only useful if staff can locate it, understand it and put it into practice under pressure. Periodic reviews and exercises help teams identify missing forms, unclear responsibilities and workflow dependencies before an actual emergency occurs.

The Need for Operational Flexibility

Recent events highlight the need for operational flexibility and the ability to transition smoothly between standard and contingency workflows. Resilience does not mean choosing digital systems instead of paper documentation, or paper instead of digital. It means preparing complementary backup strategies for different types of failure.

A cyberattack may make connected platforms unavailable while the physical facility remains intact. A flood may destroy paper records and supplies while cloud-hosted information remains available from another location. A regional infrastructure failure may leave both local devices and cloud-based systems temporarily unreachable.

Healthcare organizations should therefore consider how digital, analog and mobile documentation resources work together across multiple disruption scenarios.

Lesson 1: The 2024 Change Healthcare Cyberattack

The February 2024 ransomware attack against Change Healthcare disrupted pharmacy services, medical claims, payment systems and other healthcare transactions nationwide. HHS described the incident as posing a direct threat to critically needed patient care and essential healthcare operations. Read the HHS letter about the incident.

The American Hospital Association surveyed approximately 1,000 hospitals in March 2024. Seventy-four percent reported a direct impact on patient care, while 94% reported a financial impact. Many hospitals also described available workarounds as labor-intensive, costly and only partially successful. Review the AHA findings.

How Manual Workflows Support Continuity During Cyber Downtime

When connected systems or third-party platforms become unavailable, healthcare organizations may need to rely on approved manual processes to keep information and work moving. Depending on the affected systems, these procedures may include:

• Patient registration and intake: Paper forms can capture demographics, consent, allergies and immediate care information.
• Clinical documentation: Physical charts and downtime packets can preserve observations, orders and treatment notes until data can be reconciled.
• Medication workflows: Manual logs can support medication administration and prescription processing when electronic verification systems are unavailable.
• Communication and coordination: Telephone, radio and fax workflows can help bypass unavailable portals and messaging platforms.
• Administrative processing: Manual records can document authorizations, claims and transactions that must be entered after systems return.

Lesson 2: Natural Disasters Create Different Documentation Challenges

Hurricanes, regional power failures, floods, wildfires and evacuations can create similar operational pressures, but the most important documentation risk changes according to the event. Hurricane Katrina and Hurricane Helene illustrate why healthcare organizations need both digital and analog backup strategies.

Lesson 3: Downtime Procedures Are Patient Care Procedures

Regardless of the cause, downtime and disaster preparedness must prioritize patient care throughout response and recovery. Cyberattacks, software failures and catastrophic weather events create different technical problems, but clinicians and support staff must still provide safe, effective care.

Everyday processes that support patient care include:

Organizations with established emergency training and downtime protocols enable clinical and administrative teams to continue using backup forms, predefined responsibilities and approved digital or analog workflows until normal systems resume.

Recovery planning should also address how information created during downtime will be secured, transferred and reconciled. Paper records should not become a disconnected second record. Teams need a controlled process for validating, entering and storing information after the EHR or other primary systems return.

Building Resilience Before the Next Disruption

Nearly every healthcare organization experiences some form of downtime, including EHR outages, network interruptions, third-party service failures and power disruptions. The central question is not whether a disruption will occur, but whether the organization’s plans are comprehensive, current and regularly practiced.

Five Priorities for a More Resilient Downtime Program

1. Map critical workflows. Identify which patient care, documentation, medication, communication and administrative processes must continue during an outage.
   
   
2. Prepare both digital and analog alternatives. Plan for technology failures, physical damage, loss of internet connectivity and displacement.
   
   
3. Standardize downtime resources. Use current forms, clearly labeled downtime packets, secure mobile storage and consistent organization across care areas.
   
   
4. Train and test. Conduct realistic exercises that involve clinical, administrative, IT and emergency management teams.
   
   
5. Plan the return to normal operations. Define how downtime records will be reviewed, reconciled, entered into primary systems and retained.

The HHS HIPAA Security Rule requires appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic protected health information. Review the HHS Security Rule overview. Downtime planning should support that broader objective by helping authorized teams continue accessing and protecting the information needed for patient care.

Regular plan reviews allow organizations to update downtime policies, documentation resources, staff training and alternate communication strategies as technologies, vendors, facilities and care workflows change.

For more related guidance, read What Happens to Chart Racks and Storage in an EHR World? and Mastering Shadow Charting in EHR Rollouts.

Healthcare Downtime Preparedness FAQs