Article
If your EHR went down tomorrow morning, how would you see patients?
Here's a question I like to ask practice managers and doctors: say you walk in tomorrow at 7:30, turn on the computers, and the EHR won't come up. Not slow. Gone. What happens next?
Most folks I've talked to over the years have some version of "we'd call the vendor." That's fine for a two-hour outage. It's not a plan for a two-week one.
This isn't a hypothetical
Green Clinic in Ruston, Louisiana, found ransomware on its network around 6:30 a.m. on Friday, October 2. According to the clinic's own update, the attackers encrypted files and systems across the network, including patients' electronic medical records. In its October 8 statement, the clinic said it was rolling out a brand-new clinical system and planned to resume broader care on October 14. But a new system doesn't bring back the old records or the appointment schedule. Whether patient data was taken was still under investigation. (Green Clinic statement via Lincoln Parish Journal)
Think about what that means at the front desk. Who's on the schedule today? What meds is this patient on? What did the last visit note say? When the EHR is gone, those answers are gone with it unless you planned ahead.
I'm not bringing this up to scare anybody. I've spent more than 17 years in healthcare IT, and the practices that get through a bad day are almost never the ones with the fanciest tech. They're the ones that thought about it for an afternoon before it happened.
Know who's coming in
The first thing you lose is the schedule. Fixing that is cheap:
- Print or export tomorrow's schedule at the end of each day, or have it automatically saved somewhere that isn't the EHR or the same server.
- Keep a couple of days ahead, too. If you're down Monday, you'll want Tuesday and Wednesday.
- Make sure patient phone numbers are on it. You may need to call people.
Lots of EHRs have a built-in downtime report or a read-only backup view. Find out if yours does, who can turn it on, and whether it lives on the same network that just got hit.
Have paper ready, and practice with it
You don't need a complicated binder. You need:
- Blank visit note forms, intake forms, and prescription pads, already printed and in a known drawer.
- A simple log sheet so every paper visit gets entered later. Somebody will have to back-enter all of it, and it's much easier if it's organized.
- One short dry run. Pick a slow afternoon and have the front desk and one provider walk a pretend patient through on paper. You'll find out in 20 minutes what's missing.
Know who to call, and write it down on paper
When your systems are down, your contact list that lives in Outlook is down too. Keep a printed sheet with:
- Your EHR vendor's support line and your account number
- Your IT person, and a backup if they can't be reached
- Your cyber insurance carrier and policy number, if you have one
- Your bank, your clearinghouse, and your main pharmacies and labs
Also decide ahead of time who makes the call to go to paper. If nobody's sure, you lose an hour arguing about it.
Make sure your backups are actually separate
This is the part where the IT side matters most. Ransomware tends to go after everything it can reach, and that often includes backups sitting on the same network. A few questions worth asking:
- Is at least one copy of your data offline or somewhere the attacker couldn't get to from your office computers?
- When's the last time anybody restored something from backup to make sure it works?
- If your EHR is cloud-hosted, what does your vendor promise about getting you back up, and does your contract say so?
If you don't know the answers, that's normal. It just means it's worth finding out.
Don't forget the stuff around the EHR
Your phones, your fax, your email, and your e-prescribing may all depend on the same network. If the network goes, they can go too. Know which of those you can still use from a cell phone or a separate connection.
Want a second set of eyes?
I'm Kevin Roper, and I run Roper IT Consulting out of Holly Springs, NC. I've been in IT for more than 25 years, most of it in healthcare. I do a fixed-price $750 healthcare IT security assessment for small practices and clinics. I'll look at your backups, your downtime readiness, and the common gaps that turn a bad morning into a bad month, then give you a plain-English list of what to fix first. I work remotely with practices anywhere, and on-site around Raleigh and Wake County.
If you'd like to set one up, request a consultation at roperitconsulting.com.