The short answer. Hospitals keep patient records reachable during an EHR outage in one of four ways: paper downtime kits, printed or cached downtime reports, a read-only snapshot viewer, or a continuity system that runs on separate infrastructure. Only the last one survives a ransomware attack that takes down the hospital domain, because the other three either live inside that domain or stop at yesterday’s data. The test that matters is simple. If an attacker holds your Active Directory credentials, can your clinicians still open a chart?
Most downtime plans were written for a server that fails at 2 a.m. and comes back by breakfast. That isn’t what hospitals face now. Microsoft’s 2025 rural health cybersecurity report puts average downtime after a hospital ransomware attack at 18.7 days, at an estimated $1.9 million per day (Microsoft, 2025). Ascension ran without its EHR for 37 days in 2024, from May 8 to June 14 (Ascension public updates, 2024). A plan built for hours has to carry weeks.
The four ways hospitals reach records during downtime
Every option on the market falls into one of four groups. They differ on two things: whether they still work once the network is compromised, and whether a clinician can do anything besides read.
| Option | How it works | Survives a domain compromise? | Can clinicians document? |
|---|---|---|---|
| Paper downtime kits | Pre-printed forms, MARs and order sheets | Yes | On paper only |
| Downtime reports and local caches | Scheduled census and MAR printouts, or files on designated PCs | Only if the PCs and files were untouched | No |
| Snapshot viewer | Browser view of the last copy of the chart | Depends on where it's hosted and how you sign in | Usually no |
| Separate continuity system | Live clinical workspace fed by the EHR, hosted apart from it | Yes, if the infrastructure and sign-in are separate | Yes |
Paper is the floor
Every hospital needs current paper kits, and nothing below replaces them. Paper has two limits, though. It carries no history, so the nurse starting a shift on day six has no record of what happened on days one through five unless someone wrote it down legibly and filed it. And it only works if people follow the procedure. In a JAMIA analysis of 76 patient safety reports tied to EHR downtime, downtime procedures weren’t followed or didn’t exist in 46% of cases, and nearly half the events involved lab processes such as specimen labeling and result reporting (Larsen et al., JAMIA, 2017).
Downtime reports assume the hospital network is still up
Scheduled downtime reports and cached files on designated workstations work well for planned maintenance. In a ransomware event they share the attacker’s reach. If the designated PCs sit on the hospital domain, they’re in scope when the encryption runs.
Snapshot viewers show yesterday
A snapshot viewer gives clinicians a browser view of the chart as of the last refresh. That’s useful for allergies and active medications. It has two weak points. The data stops at the last sync, and anything done during the outage lives somewhere else. And if the viewer runs in the same cloud tenant or uses the same sign-in as production, stolen credentials reach it too.
A separate continuity system keeps working
The fourth option is a clinical workspace that the EHR feeds continuously, hosted on infrastructure the hospital domain can’t reach, with its own sign-in. When production goes dark, clinicians sign in to the separate system and keep reading and documenting. This is the only category built to answer the question at the top of this page.
Why "offline access" fails in a ransomware event
Attackers go after recovery options on purpose. Sophos surveyed 402 healthcare organizations hit by ransomware and found that attackers tried to compromise backups in 95% of attacks, and succeeded 66% of the time (Sophos, State of Ransomware in Healthcare 2024). Anything that shares the hospital’s domain or its credentials gets the same treatment as the backup.
That’s why “we have offline access” often turns out to mean “we have access while the network is healthy.” When the Windows environment is encrypted, the EHR usually goes dark within hours, often because IT takes systems offline to contain the attack. A viewer that depends on those systems goes with it.
Ask one question of every downtime option you run: which credentials does a clinician use to sign in, and could an attacker holding our domain admin account reach it?
What to ask before you buy
Use these questions for any downtime product, including ours.
- Where is it hosted, and who owns that infrastructure? A different owner and a different cloud tenant puts it outside the hospital’s blast radius.
- How do clinicians sign in during an event? Separate credentials mean a compromised Active Directory doesn’t grant access.
- How current is the data when the outage starts? A continuous HL7 feed beats a nightly snapshot on day one of an outage.
- Can clinicians document, or only read? Reading covers the first shift. Documenting covers the next three weeks.
- What happens to the records created during downtime? If the answer is paper reconciliation, budget the staff hours now.
- Can you prove it before you need it? A product you can activate during planned maintenance lets you test it without waiting for an attack.
Where Spare Tire fits
Spare Tire is built for the fourth category. It runs on an external cloud, not the hospital’s own cloud or data center, and clinicians sign in with separate credentials, so a compromised hospital domain has no path to it. In day-to-day operation it receives data from the primary EHR over HL7, which keeps the chart current when an outage starts. During an event, clinicians use it to review charts, document care, place orders and verify medications from devices IT has cleared for the incident.
It works alongside Epic, Oracle Health (Cerner), MEDITECH or any HL7-capable EHR, operates under a Business Associate Agreement, and keeps data in the US by default. When the primary EHR comes back, the records are validated before anything is written back, so a still-compromised environment can’t receive them.
The lowest-risk way to evaluate it is during a planned maintenance window: activate it, time it, and let clinicians use it on a real shift.
Frequently asked questions
How do clinicians access patient records when Epic is down?
Most Epic hospitals use a combination of paper kits, Epic’s own downtime tools on designated workstations, and in some cases a separately hosted continuity system. The first two depend on the hospital network. In a ransomware event that encrypts the domain, only an option hosted outside that domain with its own sign-in stays reachable.
Is read-only access enough during a long outage?
For the first few hours, often yes. Across a multi-week outage, clinicians also need to document care and place orders, and doing that on paper produces a backlog that has to be re-entered later. Microsoft’s 2025 report puts average post-ransomware downtime at 18.7 days (Microsoft, 2025).
What's the difference between a downtime viewer and a continuity system?
A downtime viewer shows the chart as of its last refresh. A continuity system is a live clinical workspace that clinicians can document in during the outage, with those records returned to the EHR after recovery.