Draft:Electronic health record availability

Electronic health record availability is the ability of electronic health record (EHR) systems to keep clinical information accessible and usable by authorized health care professionals when it is needed for patient care.

In information security, availability is one of the three components of the CIA triad, together with confidentiality and integrity. In health care, availability involves more than keeping an application or server continuously operational: it also includes the ability to retain access to clinically necessary information when the usual access path is unavailable, and to restore normal operations safely.

Loss of access to an EHR can directly affect clinical care because information such as medication lists, allergies, test results, diagnoses, and previous treatment may no longer be available through the usual workflow. Technical standards, safety guidance, and the health informatics literature therefore treat continuity of access as both an information-security issue and a patient safety concern.

Approaches to maintaining availability include measures activated during a system interruption as well as system architectures intended to reduce dependence on a single access path. They include downtime procedures, alternative methods of viewing clinical information, local operation with data synchronization, and backup and recovery mechanisms.

Clinical significance of EHR downtime

Electronic records have become central to activities such as reviewing medical history, prescribing, ordering and reviewing tests, and documenting care. When EHR systems are unavailable, clinical teams may need to use alternative workflows and may have slower or more limited access to information needed for clinical decisions.

Studies of EHR downtime have identified problems involving patient identification, medications, laboratory testing, and clinical workflows. In emergency departments, prolonged outages have been associated with increased workload and longer patient stays, while studies in surgical settings have also examined operational effects of temporary loss of EHR access.

Downtime may be planned, such as during maintenance, or unplanned as a result of software or hardware failure, power outages, loss of Internet or internal network connectivity, disasters, or security incidents. Because different failures affect different parts of an information system, continuity of care depends not only on restoring the primary EHR but also on procedures and alternative paths for obtaining clinically necessary information.

Availability and information security

Availability is a fundamental property of information security. Confidentiality concerns preventing unauthorized disclosure, while integrity concerns preserving the accuracy and consistency of information. Availability concerns whether information and services can be accessed and used when required.

This property has particular importance in health care because unavailable information can directly affect clinical work. ISO 27799 specifies information-security controls for health information and applies to information processed in different technical environments, including local infrastructure and cloud-based services. The National Institute of Standards and Technology (NIST) Special Publication 800-66, which provides guidance for implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule in the United States, similarly treats confidentiality, integrity, and availability as properties that must be protected for electronic protected health information.

Protecting an EHR therefore involves more than preventing unauthorized access or modification. It also involves planning how necessary clinical information will remain accessible when a system, network, Internet connection, or another normally used component becomes unavailable.

Continuity and resilience strategies

Strategies for maintaining EHR access can operate in two complementary ways: through contingency mechanisms activated during downtime, and through system architecture designed to reduce dependence on a single access path. The former include operational procedures, standby systems, and recovery mechanisms. The latter include architectures that maintain data or functions locally and synchronize them with remote infrastructure, allowing one access path to remain usable when another is interrupted.

These mechanisms serve different purposes. A backup can allow data to be restored after a failure but does not necessarily provide immediate access during an outage. Similarly, a downtime procedure may preserve part of the clinical workflow after the primary system becomes unavailable, whereas an architecture capable of local operation may allow normal functions to continue through some types of connectivity failure.

Multiple access paths and local operation

Some EHR systems are designed to provide more than one way of accessing clinical information during normal operation. For example, a system may keep operational data and functions on local, on-premises infrastructure, while synchronizing changes with remote infrastructure when connectivity is available. In this configuration, loss of external connectivity does not necessarily interrupt local operations.

This differs from a contingency system that is activated only after a failure. In an offline-first architecture, the local data store forms part of the routine read-and-write workflow, and changes are synchronized or reconciled with a central or remote system when communication becomes available.

Where copies or services can be reached through distinct paths, failure of one component does not necessarily remove every means of accessing clinical information. A connectivity failure may leave local operation unaffected, while a local equipment or infrastructure failure may be mitigated by synchronized data or services maintained elsewhere, depending on the implementation.

Local infrastructure or multiple access paths do not by themselves guarantee availability. The SAFER contingency-planning guidance recommends considering hardware duplication, network redundancy, and data replication as part of disaster recovery planning. Systems that maintain multiple writable copies must also preserve integrity and address synchronization and possible differences between versions.

A 2026 feasibility study evaluated an offline-first EHR used in clinics serving vulnerable populations, including its operation and synchronization under intermittent connectivity. Other studies have examined continuity during EHR downtime through contingency planning, local backup systems, and dedicated downtime procedures in health care settings.

Implementation examples

Systems combining local or disconnected operation with synchronization have been implemented in different clinical settings. Designs vary: some use a local database or server synchronized with central infrastructure, while others allow installed applications to retain the clinical data required for offline work and synchronize changes when connectivity returns.

In the United States, Binsera EHR is described by its developer as an offline-first EHR in which critical clinical functions can use locally available data during connectivity outages. Its documented offline functions include clinical documentation, medication information, and orders; changes are synchronized with remote infrastructure after connectivity is restored, with conflict handling and audit logging.

Tamanu, developed by the Australian organization Beyond Essential Systems, is an open-source electronic medical record designed for environments without continuous connectivity. The World Health Organization describes Tamanu as offline-first and capable of synchronization. Its facility architecture can use local servers that continue serving users without Internet access and synchronize bidirectionally with central infrastructure when communication is available.

In the United Kingdom, Morse is a mobile electronic patient record used by organizations of the National Health Service. NHS Shetland reported that clinicians can access and enter patient information while offline, with records and notes synchronized when a connection becomes available.

In Brazil, HiDoctor combines locally installed software with synchronized data and remote access. A 2013 academic study at the Federal University of Pelotas described its MedSync technology as keeping databases updated across computers used in locations such as a medical office, home, and hospital while also providing Internet access to the information. Current product documentation describes each installed computer or device as a synchronization point that exchanges changes with other points, while synchronized data can also be accessed through a web interface.

Denmark-based Auditdata Manage, used in audiology services, operates with the desktop Bridge application. Selected patient data can be loaded into Bridge for offline clinical work and synchronized back to the online Manage database when connectivity is restored.

In Italy, Graffico develops custom clinical-management and electronic-record systems. For deployments requiring continued operation during connectivity problems, the company describes an optional offline mode in which required functions and data remain available locally and data are synchronized automatically after connectivity returns. Unlike a fixed feature of a single standardized product, this architecture is described as being selected according to the requirements of each deployment.

Downtime and contingency procedures

Contingency plans define how clinical work should continue when electronic systems are unavailable. They may include paper forms, temporary procedures for patient identification and prescribing, defined staff responsibilities, communication methods, and processes for entering information into the EHR after normal service has been restored.

Preparation can also include periodic drills so that staff know how to work during an outage. The effectiveness of downtime procedures depends not only on technical infrastructure but also on training, assignment of responsibilities, and prior identification of clinical functions that need to be restored first.

Redundant and alternative access paths

Even where the primary EHR is not designed for disconnected operation, organizations may deploy systems specifically intended for downtime. These mechanisms aim to preserve at least read access to clinical information while the primary system is being recovered.

Reported approaches include read-only copies, independent repositories, and local downtime viewers. In one hospital network, a downtime viewer maintained recent clinical data on computers in patient-care areas after access to the primary EHR was lost. Studies of EHR contingency planning have also identified clinic-level read-only backup systems among practices used to support continuity of care.

The usefulness of an alternative path depends on its independence from the failure that caused the outage. A contingency web page hosted on a separate server, for example, may still be unavailable if it depends on the same failed network. Availability can therefore involve diversity of access paths as well as conventional server redundancy.

Offline synchronization

Systems that allow disconnected work must subsequently synchronize locally produced changes with other repositories. In environments with multiple devices, the process must incorporate changes produced at different points while preserving consistency among copies.

Synchronization becomes more complex when multiple devices or facilities record changes before reconnecting to the central repository. Continuity of access must therefore be balanced with preservation of information integrity.

Backup and recovery

Backups have a different role from mechanisms that maintain access during an outage. Their primary purpose is to enable systems and data to be restored after loss, corruption, or unavailability of the original infrastructure.

Recovery planning includes identifying critical systems, setting priorities and acceptable restoration times, maintaining suitable backups, and periodically testing whether restoration actually works. The existence of a backup file without tested restoration procedures does not itself ensure information availability.

Repositories separate from the primary EHR may also preserve access to specific clinical resources. A study published in 2025, for example, evaluated an offsite repository intended to keep clinical order sets available during EHR downtime.

Data governance

Availability is also part of data governance in health care. Governance of clinical information includes assigning responsibility for access, maintaining data quality and integrity, defining retention requirements, and ensuring that information remains available throughout its life cycle.

The location and distribution of data copies are only some elements of that governance. Maintaining both local and remote access paths can reduce dependence on a single access point, but it also requires rules for access control, updating, integrity, synchronization, and recovery. Likewise, using externally hosted infrastructure does not remove an organization's responsibility to establish how its information can be accessed and recovered when required.

From a continuity perspective, a central objective is to avoid making access to clinically necessary information dependent on a single point of failure. The SAFER guidance identifies single points of failure, including dependence on a single Internet connection, as a risk to information availability and integrity. Organizations therefore need to understand where their data are stored, how they are accessed and synchronized, how they can be recovered, and which alternatives will remain available if the usual access path fails.

United States

In the United States, EHR availability is addressed in part through the HIPAA Security Rule. The rule applies to electronic protected health information (ePHI) held by regulated entities rather than specifically to EHR products. It requires regulated entities to ensure the confidentiality, integrity, and availability of the ePHI they create, receive, maintain, or transmit. The United States Department of Health and Human Services defines availability in this context as information being accessible and usable on demand by an authorized person.

The Security Rule also requires contingency planning for emergencies or other events that damage systems containing ePHI. HHS guidance describes this as including plans for data backup, restoration of lost data, and continuation of critical processes in emergency mode. NIST SP 800-66 Rev. 2 provides implementation guidance for these requirements and addresses contingency planning, recovery, testing, and assessment of critical services.

The rule is technology-neutral and does not prescribe a particular local, cloud, or hybrid EHR architecture. Separately, the Office of the National Coordinator for Health Information Technology's SAFER guidance addresses planned and unplanned EHR unavailability and provides recommended practices for downtime preparation, continued access to clinical information, and recovery.

See also

• Electronic health record
• Electronic health record confidentiality
• Health information management
• Information security
• Business continuity planning
• Disaster recovery
• Patient safety
• Data governance

References

Category:Electronic health records Category:Information security Category:Patient safety