The short answer. A hospital downtime system is the set of tools, roles and procedures that keeps clinicians reading charts, documenting care and placing orders whenever the EHR is unavailable: a scheduled upgrade, a failed software update, a network or power outage, or a cyberattack. Build it for the hardest case, a compromised hospital network, and it covers every easier one. That takes a clinical record that lives outside the hospital domain, named people who know when to switch to it, and drills that test it.
Every reason the EHR goes down
Downtime isn’t rare and it isn’t only ransomware. Every hospital takes the EHR down for planned upgrades and maintenance. Unplanned outages come from failed servers, network and power problems, and software failures outside the hospital’s control. On July 19, 2024, a faulty CrowdStrike update crashed Windows systems worldwide. CrowdStrike said it was not a cyberattack, yet Mass General Brigham lost access to clinical systems including patient records and canceled all non-urgent visits, and Harris Health System canceled outpatient appointments and elective procedures (Fierce Healthcare, July 2024).
| Type of downtime | Typical length | What clinicians need |
|---|---|---|
| Planned upgrade or maintenance | Hours, on a known schedule | A current chart and a place to document |
| Server, network or power failure | Hours to days | The same, without warning |
| Third-party software failure | Hours to days | Access that doesn't depend on the failed workstations |
| Cyberattack | Weeks | All of the above, outside the hospital domain |
Why plan for the hardest case
Downtime plans used to be written for hours. Microsoft’s 2025 rural health cybersecurity report puts average downtime after a hospital ransomware attack at 18.7 days, at an estimated $1.9 million per day (Microsoft, 2025). Attackers also aim at recovery. Sophos found attackers tried to compromise backups in 95% of the healthcare ransomware attacks it surveyed, and succeeded in 66% (Sophos, State of Ransomware in Healthcare 2024). A downtime system that shares the hospital’s network or sign-in is part of the same target.
What a hospital downtime system is
A downtime system is anything clinicians use to keep caring for patients while the EHR is unavailable. In practice that covers four layers:
| Layer | What it does | Holds up when the domain is compromised? |
|---|---|---|
| Paper kits | Forms, MARs and order sheets | Yes, but carries no history |
| Downtime reports and cached files | Census, MAR and order printouts on designated PCs | Only if those PCs weren't encrypted |
| Read-only snapshot viewer | Browser view of the last copy of the chart | Depends on hosting and sign-in |
| Separate continuity system | Live clinical workspace fed by the EHR, hosted apart from it | Yes, if hosting and credentials are separate |
For a planned upgrade, most of these work. The hardest case sorts them quickly. If an attacker holds your domain admin credentials, which of these can a nurse still open? For most hospitals the honest answer is paper, and whatever was printed before the encryption ran. Our offline EHR access guide compares the four options in detail.
The roles that make it work
Tools fail without owners. Before anything else, name a person (and a backup) for each of these:
| Role | Decides or does |
|---|---|
| Downtime incident lead | Declares clinical downtime and the switch to the downtime system |
| Security lead | Confirms which systems and devices are cleared for use during the incident |
| Clinical informatics | Runs the downtime workspace, answers "where do I document this?" |
| Unit downtime champions | One per unit per shift, keep the unit on the procedure |
| HIM | Owns patient matching and the reconciliation plan for recovery |
| Communications | Tells staff, physicians and patients what's happening, on channels that don't depend on hospital email |
The last row matters more than it looks. If the hospital’s email and Teams run on the compromised domain, the downtime announcement can’t go out through them.
How to build downtime procedures that hold up for every outage
1. Write down every scenario, then plan for the worst one
List the outages you expect: scheduled upgrades, a failed server, a network or power outage, a vendor software failure, a cyberattack. Then plan around the hardest: Active Directory compromised, Windows endpoints down, EHR offline for at least 18 days. A procedure that holds up there holds up for a two-hour upgrade.
2. Put the clinical record somewhere the outage can’t reach
Pick at least one option from the bottom of the table above that runs on separate infrastructure with separate credentials and stays current through a continuous feed from the EHR. A copy that stops at last night’s backup leaves a gap on day one.
3. Decide which devices clinicians will use
Encrypted workstations are off the table. Decide in advance which devices are cleared for use during an incident (new loaners, tablets, phones on a separate network) and how the security lead approves them.
4. Pre-provision access
Clinicians shouldn’t be creating accounts during an attack. Set up downtime credentials ahead of time, separate from hospital Active Directory, and test that people can sign in. HIPAA’s Security Rule already requires an emergency access procedure for electronic PHI (45 CFR 164.312(a)(2)(ii)).
5. Plan the return before the outage
Every record created during downtime has to get back into the chart without reinfecting it. Decide who confirms the restored EHR is clean, how records are matched to patients, and how conflicts go to a clinician. Our sync-back checklist covers the five checks.
6. Drill it against the real scenario
CMS already requires hospitals to exercise their emergency plan at least twice a year, including an annual full-scale or functional exercise (42 CFR 482.15(d)(2)). Make one of those a cyber exercise: domain down, EHR offline, units working from the downtime system for a full shift. Time how long it takes to declare downtime and get the first nurse signed in. Between exercises, every planned maintenance window is a free live drill.
Ask one question of every downtime option you run: which credentials does a clinician use to sign in, and could an attacker holding our domain admin account reach it?
Where the rules already point
You don’t need a new mandate to justify this work. CMS requires hospitals to maintain “a system of medical documentation that preserves patient information” and “secures and maintains the availability of records” as part of emergency preparedness (42 CFR 482.15(b)). HIPAA requires a contingency plan with data backup, disaster recovery and emergency mode operation plans (45 CFR 164.308(a)(7)). And under the FY 2026 IPPS final rule, hospitals in the Medicare Promoting Interoperability Program must attest “yes” to completing SAFER Guides self-assessments (WHA summary of the CMS final rule, August 2025). The 2025 SAFER Guides from ASTP/ONC still include a Contingency Planning guide.
Where Spare Tire fits
Spare Tire® is built for step two, and for every type of downtime in the table at the top: planned upgrades and maintenance, unplanned outages, third-party failures and cyberattacks. It runs on an external cloud, not the hospital’s own cloud or data center, and clinicians sign in with separate credentials, so neither a failed hospital system nor a compromised hospital domain takes it down with the EHR. In normal operation it receives data from the primary EHR over HL7, which keeps the chart current when an outage starts. During an event, clinicians use it to review charts, document care, place orders and verify medications from devices IT has cleared for the incident.
It works alongside Epic, Oracle Health (Cerner), MEDITECH or any HL7-capable EHR and operates under a Business Associate Agreement. Records created during downtime stay in Spare Tire’s external cloud, outside the hospital network, so an attacker inside the hospital domain has no path to them while IT restores the primary EHR.
The easiest way to drill it is during a planned maintenance window. Activate it, time it, and let one unit work a shift in it.
Frequently asked questions
What is a hospital downtime system?
The tools and procedures clinicians use to keep caring for patients whenever the EHR is unavailable, planned or unplanned: paper kits, downtime reports, read-only viewers and separate continuity systems. The strongest ones keep working even when the hospital network itself is compromised.
How often should hospitals run downtime drills?
CMS requires hospitals to exercise their emergency plan at least twice a year (42 CFR 482.15(d)(2)). Use planned maintenance windows as live drills, and make one formal exercise a full-network scenario so the system is tested against the worst case too.
How long should a downtime plan cover?
A planned upgrade may last hours, but plan for weeks. Microsoft’s 2025 report puts average downtime after a hospital ransomware attack at 18.7 days.