Published
- Medical groups
- Operator transition teams
- Public purchasers
- EHR implementation teams
Prepared · sources accessed (UTC) · physician review still to be recorded
Moving a chart is not the same as transferring responsibility for the care described in it. A practice can migrate years of documents and still lose an appointment awaiting acceptance, a medication-monitoring task, or a result due after the original clinician leaves. During technology downtime, the same problem arises in a different form: care continues while the usual record and task system is unavailable.
This guide helps clinical leaders build a continuity plan around active obligations. It covers planned transitions and interrupted systems, with a fictional handover exercise and a practical register. Technical recovery, cybersecurity response, privacy, labor issues, and contractual allocation require separate professional assessment.
Transfer active tasks alongside historical records
Identify the work that must remain visible after the transition: pending results, incomplete investigations, referrals, medication changes, monitoring, patient callbacks, and care plans that depend on a specific clinician or service. For each task, record the next action and accepted recipient.
A historical document may explain why a task exists but fail to place it in the receiving team’s work queue. Test both dimensions. Can the receiving clinician retrieve the source? Can the team find the unfinished task without searching every imported note? Record known exclusions from the migration or handover rather than treating an export count as proof of clinical continuity.
Use a sample containing ordinary completed encounters and deliberately selected unfinished care. A transfer that works only for closed encounters has not tested the main continuity problem.
Set inbox coverage before a clinician leaves
Clarify when the departing clinician’s responsibility ends, what access remains lawfully available, and who receives new information afterward. Define how the team handles results from earlier orders, outside reports addressed to the departing clinician, refill requests, and messages sent to an old portal account.
Use a roster with a named acceptance process. Test the forwarding configuration and a fallback if it fails. Do not leave patients to infer that a change in staffing means their unresolved question has been reassigned. The SAFER test-results guide identifies departures and handoffs as vulnerable points requiring explicit follow-up arrangements.
The continuity plan should not require unauthorized personal copies of patient records. Establish an approved custodian and a lawful route for later clinical or legal access when needed.
Reconcile pharmacy and referral changes
A new pharmacy arrangement can alter ordering routes, stock availability, delivery, and the meaning of task statuses. Review patients with time-sensitive or complex ongoing medication needs through an appropriate clinical prioritization process. Verify what was ordered, what was supplied, and who can resolve a discrepancy.
For referrals, transfer more than a list of destinations. Include the clinical question, urgency, acceptance status, missing prerequisites, patient barriers, and the next planned check. Ask the receiving team to acknowledge unfinished referrals explicitly. A statement that “records were sent” does not show that a service accepted clinical responsibility.
If an organization or vendor changes, document which old communication channels remain active and for how long under the authorized transition plan. Assign ownership of messages that arrive through those channels.
Prepare to work without the usual system
The ONC SAFER contingency-planning guide addresses downtime training, communication independent of the EHR infrastructure, and recovery procedures. It is a safety resource, not proof that an organization meets every legal or program requirement.
For the selected setting, identify the minimum information needed to provide safe care, how authorized staff can obtain it, and which services must be limited or redirected when information is insufficient. Prepare approved paper or alternative workflows for patient identification, orders, medication administration where relevant, results, and task assignment.
Do not rely on a downtime policy stored only in the unavailable system. Test access to instructions and contacts. The clinical lead and technical lead should have defined, distinct responsibilities, including who declares the alternative workflow active and who authorizes return to normal operations.
Fictional worked case: the system returns before the work is reconciled
Fictional case. A community practice experiences a four-hour EHR interruption during a planned vendor transition. Staff use approved paper encounter forms and a temporary results log. At restoration, the team scans the forms and resumes electronic work. Two laboratory orders were also entered electronically before the interruption, but their status was unclear during downtime.
The first proposed recovery plan is to enter every paper order as new. A clinician recognizes that this could duplicate orders. The team instead compares the pre-interruption queue, paper records, and restored system. It identifies which orders already exist, which actions occurred offline, and which tasks remain open. Each unresolved item receives an owner.
The exercise also reveals an outside report sent to the departing physician’s old inbox. The receiving clinician accepts the follow-up after reviewing the source and the patient’s current situation. The team changes the transition checklist to test old-address messages as well as new-system messages.
No patient outcome is specified. The exercise demonstrates a recovery risk and a reconciliation method; it does not establish the cause of a real incident or certify a migration.
Recovery requires reconciliation, not just data entry
Set rules for bringing downtime records into the restored system while preserving the actual event times and authorship. Distinguish the time care occurred from the later entry time. Avoid making a late entry look contemporaneous or overwriting an earlier record without an appropriate amendment trail.
Reconcile orders, results, medication actions, and pending communications. Check for duplicates, unmatched results, missing acknowledgments, and paper tasks with no electronic owner. A scan may preserve the document but fail to create the task that someone must perform.
After restoration, maintain a visible exception list until each consequential discrepancy has a reasoned disposition. Technical availability and clinical recovery are related milestones; the second can require work after the first has occurred.
Continuity and recovery register
Use this register for a selected handover or interruption. Keep patient-level entries in approved systems and record who verifies completion.
| Item | Outgoing state or source | Receiving owner | Access verified | Action during transition | Reconciliation evidence |
|---|---|---|---|---|---|
| Pending result | ______ | ______ | ______ | ______ | ______ |
| Medication or monitoring task | ______ | ______ | ______ | ______ | ______ |
| Incomplete referral | ______ | ______ | ______ | ______ | ______ |
| Patient communication | ______ | ______ | ______ | ______ | ______ |
| Paper or alternative-system record | ______ | ______ | ______ | ______ | ______ |
| Old inbox or external interface | ______ | ______ | ______ | ______ | ______ |
Before implementation, run a tabletop with a result arriving late, an unavailable receiving clinician, a patient who cannot use the new portal, and a partially completed order. Record the first failed assumption in each scenario. After implementation, repeat the selected scenarios safely and examine a sample of actual unresolved work.
Questions readers ask
Is a successful data migration enough to establish continuity?
No. It can establish a technical transfer within the tested scope. Clinical continuity also requires accessible information, accepted tasks, usable communication, and a response when the next step fails.
Should every paper order be entered again after restoration?
Use the organization’s reconciliation process to establish whether it already exists or was completed. Blind re-entry can create duplicates; failing to enter an unresolved order can lose the task. Record the decision and its source.
Can a downtime drill use real patients?
Training can usually begin with fictional or approved test records. Any exercise involving live systems or patient data needs appropriate operational, privacy, and safety controls. A drill should not inadvertently change real care.
Related resources and sources
Existing foundations: continuity during organizational change, clinical governance, and medication continuity. Continue with workflow responsibility, medication transitions, and employment and departure documents.
Source and scope note. Primary sources are ONC’s contingency and test-results SAFER guides, linked above. Program use has changed: beginning with the CY 2026 EHR reporting period, CMS requires eligible hospitals and critical access hospitals to attest to an annual self-assessment using all eight SAFER Guides published in January 2025 (FY 2026 IPPS final rule). ONC's SAFER landing page still describes the 2016 versions as applicable to program measures, so confirm current attestation requirements, including those for MIPS clinicians, directly with CMS. Prepared November 5, 2026 Pacific.