EPR Downtime in the NHS: Keeping Care Visible When Digital Systems Go Offline

When an electronic patient record goes offline, patient care does not stop. Admissions continue, medicines are still required, test results must be acted upon and staff still need a reliable picture of what is happening across the ward.

An EPR outage can therefore become much more than an IT problem. Within minutes, it can affect clinical documentation, prescribing, investigations, patient flow and communication between teams.

EPR downtime may be planned for an upgrade or maintenance window. It may also be unplanned, following a local technical fault, loss of connectivity, power interruption, supplier failure or cyber incident. Whatever the cause, patient care does not simply pause until the system returns.

Staff still need to receive patients, coordinate beds, complete handovers, manage urgent actions and maintain safe records. This makes EPR downtime more than an IT problem. It is also a clinical, operational and communication challenge.

Safe continuity depends on the organisation’s approved downtime procedures. These will usually combine alternative digital access where available, authorised paper documentation, clearly assigned responsibilities and a reliable way for teams to maintain shared situational awareness.

What is EPR downtime?

EPR downtime is any period in which staff lose access to some or all of the functionality of an electronic patient record system.

An EPR is rarely just a digital replacement for handwritten notes. Depending on the organisation and system, it may support:

• Clinical documentation and ward-round notes
• Electronic prescribing and medicines administration
• Allergy and risk information
• Pathology and radiology requests
• Test results
• Admissions, discharges and transfers
• Patient tracking and operational dashboards

An outage can therefore be partial or widespread. One interface may stop updating while the main record remains available, a single ward may lose access, or several connected services may become unavailable across an entire organisation.

The Health Services Safety Investigations Body describes loss of EPR functionality as potentially short or long term, planned or unplanned. In January 2026, it launched an investigation examining how healthcare organisations prepare for, recognise, respond to and learn from these events.

EPR and EPRR are different terms. EPR means Electronic Patient Record. EPRR means Emergency Preparedness, Resilience and Response. EPR downtime arrangements may form part of an organisation’s wider business-continuity and EPRR planning.

Why an EPR outage is not only an IT problem

Technical teams are responsible for investigating and restoring the affected system, but frontline services must continue operating while that work takes place.

The immediate challenge is often the loss of a current, shared picture. Information that staff usually retrieve from one system may have to be located through several temporary processes. Changes that would normally update across the organisation may instead need to be communicated manually.

Common operational pressures can include:

• Confirming which systems, departments and interfaces are affected
• Accessing the latest available patient information
• Recording new activity through approved downtime documentation
• Managing admissions, transfers and discharges that occur during the outage
• Communicating outstanding actions between teams and shifts
• Preventing temporary information from becoming mistaken for current information
• Reconciling manual records and completing necessary back-entry after recovery

These pressures can increase as downtime continues. New information is created, staff change shifts and the gap between the restored EPR and current operational reality becomes larger. A good downtime process must therefore cover both continuity during the incident and controlled recovery afterwards.

Business continuity and disaster recovery are not the same thing

The terms are often used together, but they address different needs.

Disaster recovery focuses on restoring systems, infrastructure and data. Business continuity focuses on how the organisation keeps essential services operating while disruption continues. NHS England makes this distinction within its Data Security Standard 7 continuity-planning guidance.

There is no single universal EPR downtime procedure for every NHS organisation. The correct response will depend on the local EPR, connected systems, clinical setting and approved business-continuity plan. However, effective arrangements commonly need to cover:

• How downtime is identified, declared and escalated
• Who is authorised to activate and stand down the contingency process
• How staff access the most recent reliable information
• Which approved paper forms and processes must be used
• How new patients and movements are identified and tracked
• How instructions and status updates reach every affected team
• Who owns coordination on each ward or department
• How records are reconciled once systems return
• How staff are trained and the plan is exercised

A publicly available Gloucestershire Hospitals EPR business-continuity plan, for example, includes designated continuity computers, locally available paper documentation, patient-tracking information, a ward downtime coordinator and processes for transferring information back into the restored EPR. This is one local example rather than a template for other trusts, but it demonstrates that downtime involves people, information and physical processes as well as technology.

Preparedness also needs to be tested. Royal Devon has previously carried out a digital downtime preparedness exercise in which staff used a backup system and pen-and-paper clinical documentation while its EPR was treated as unavailable.

Where physical systems fit during EPR downtime

Physical systems can provide a dependable layer of visibility when normal screens, dashboards or connected devices are unavailable. They can help a team see the current operational position without requiring a login, network connection or working interface.

However, their role must be defined carefully:

A physical board does not replace the EPR or the authorised downtime record. It supports coordination around the approved temporary workflow.

A well-designed physical downtime system may support four broad needs.

1. Shared operational status

A structured board can make the declared status of the incident visible to the relevant team. It may show which systems are affected, when the information was last updated, who is coordinating the local response and when the next update is expected.

2. Roles, actions and escalation

Printed headings can prompt staff to record locally agreed roles, priority actions, unresolved issues and escalation routes consistently. This is particularly useful during handovers, when verbal information could otherwise be lost between shifts.

3. Access to current instructions

Physical document displays can keep approved downtime instructions, checklists and forms accessible in the area where they are needed. Documents should be version-controlled and reviewed as part of the organisation’s normal business-continuity arrangements.

4. Organisation of paper documentation

Where the local plan requires paper documentation, appropriate holders, wallets or clearly designated storage can help keep it organised and available to authorised staff. The record itself must still be completed, handled and reconciled in accordance with the trust’s approved procedure.

The precise board layout and documents required will vary between organisations. Physical resources should be configured around the trust’s approved downtime procedure, terminology and information-governance requirements.

What makes a physical downtime system fit for purpose?

A blank whiteboard may be immediately available, but it leaves staff to invent the layout, headings and rules while already working under pressure. A purpose-designed system can provide more consistency by building the agreed workflow into the surface itself.

A downtime-ready visual system should be:

• Aligned with the local plan: headings, terminology and sections should reflect the organisation’s approved procedure.
• Clearly time-stamped: users should be able to see when the status was last updated and whether information remains current.
• Owned: responsibility for updating each area should be explicit.
• Easy to interpret: staff should be able to distinguish current status, outstanding actions, decisions and recovery work quickly.
• Suitable for handover: the structure should help information pass safely between roles and shifts.
• Legible and durable: the surface must remain readable through frequent writing, erasing and cleaning.
• Positioned appropriately: the board or display should be available to the staff who need it without exposing information unnecessarily.
• Tested: the physical system should be used during exercises so that layout or workflow problems can be corrected before a real outage.

Maintaining confidentiality during downtime

Visible information is useful only when it is visible to the right people.

Patient and operational information must continue to be handled in accordance with information-governance requirements during an outage. Downtime is not a reason to display more information than necessary or place confidential details where patients, visitors or unauthorised staff may see them.

Depending on the setting and local policy, controls may include:

• Locating operational boards within staff-only areas
• Using only approved identifiers
• Displaying the minimum information required for the purpose
• Using confidentiality doors or lockable covers
• Separating general incident information from patient-specific information
• Securely clearing boards and disposing of temporary material after use

NHS England’s confidentiality guidance should be considered alongside the trust’s own information-governance policies.

Preparing before an EPR outage

The best time to establish a physical continuity process is before it is needed. Preparation should bring together clinical teams, digital services, EPRR, information governance, pharmacy where relevant, estates and the people who will use the process on the ward.

Useful preparation questions include:

1. Which information and functions become unavailable if the EPR goes down?
2. Which connected systems might continue working, and which depend on the EPR?
3. Who declares downtime and how will staff be notified?
4. Where are the latest approved forms, instructions and contact details?
5. Who maintains the shared operational picture in each area?
6. How will new admissions, transfers and urgent outstanding actions be coordinated?
7. How will confidential information be protected?
8. What must be communicated at every shift handover?
9. How will temporary documentation be reconciled when the EPR returns?
10. Has the process been tested with night, weekend and temporary staff?

During downtime: maintain one clear operational picture

Once the organisation’s approved downtime procedure has been activated, consistency becomes particularly important.

Teams should know:

• Which process is currently in force
• Where the latest instructions are held
• Who owns local coordination
• When information was last updated
• Where the authorised clinical record is being maintained
• How urgent issues should be escalated
• How information will be handed over to the next shift

Physical boards and displays are most useful when they reinforce this agreed structure. They should not become an additional unofficial record or an uncontrolled collection of notes.

When the EPR returns: recovery is part of the incident

Technical restoration does not necessarily mean that normal working can resume immediately. Information created during downtime may need to be checked, transferred and reconciled before the electronic record becomes fully current again.

The local recovery process may need to address:

• Formal confirmation that the system is stable and may be used
• Controlled transition from paper or alternative processes
• Back-entry and verification of information recorded during downtime
• Resolution of outstanding requests, results or patient movements
• Secure retention or disposal of temporary documentation
• Closure and clearing of physical incident boards
• Debriefing and improvement of the downtime plan

A visible recovery section can help teams coordinate this workload, but it should support rather than replace the organisation’s formal reconciliation and sign-off process.

Designing physical contingency systems around NHS workflows

The most effective physical systems begin with the organisation’s existing process – not with a generic board template.

An approved downtime procedure, existing form, checklist or rough sketch can be translated into a durable layout with clearly printed prompts and update areas. Depending on the environment, the wider system may include:

• Bespoke printed whiteboards for operational status, roles and actions
• Major incident and response boards for structured coordination
• Pocket information displays for approved instructions and documents
• Patient record holders and notes wallets for locally authorised bedside documentation
• Confidentiality doors, lockable covers and other controls where appropriate

Visual Systems Healthcare works with NHS and private healthcare teams to turn existing operational requirements into bespoke physical communication systems. The clinical content and information controls remain governed by the organisation; our role is to help make the approved process clear, usable and suitable for the environment in which it will operate.

Building resilience around digital care

EPRs are an essential part of modern healthcare. Preparing for downtime does not undermine digital transformation – it makes that transformation more resilient.

The strongest arrangements recognise that technology restoration, clinical documentation and operational coordination are related but distinct needs. Approved paper processes can preserve the clinical record. Digital and technical teams can restore the affected services. Physical visual systems can help frontline teams maintain a clear, shared picture while disruption continues.

When these elements have been planned, tested and designed to work together, staff do not have to invent a new workflow at the moment they are under the greatest pressure.

Frequently asked questions

What is the difference between EPR and EPRR?

EPR means Electronic Patient Record. EPRR means Emergency Preparedness, Resilience and Response. Although they are different terms, arrangements for EPR downtime may form part of an NHS organisation’s wider business-continuity and EPRR planning.

What is EPR downtime in the NHS?

EPR downtime is a period in which NHS staff cannot access or use some or all of an electronic patient record system. It may be planned for maintenance or unplanned because of a technical fault, connectivity failure, power interruption, supplier problem or cyber incident.

Can a whiteboard replace an electronic patient record during an outage?

No. A whiteboard can support operational coordination and shared situational awareness, but it is not a replacement for the EPR or the authorised clinical downtime record.

Do NHS hospitals use paper records during EPR downtime?

Many local downtime plans include approved paper documentation, although the exact process differs between organisations and clinical settings. Staff should use only the forms and procedures authorised by their own trust.

How should confidential information be protected during downtime?

Organisations should continue to apply their normal confidentiality and information-governance controls. Measures may include staff-only positioning, approved identifiers, data minimisation, confidentiality doors and secure clearing or disposal after the incident.

What should an EPR downtime board contain?

The layout should be based on the organisation’s approved local process. It might include incident status, affected systems, update times, responsible roles, priority actions, escalation information and recovery progress. Any patient information must follow local clinical-safety and information-governance requirements.

Record Holders

Bespoke Whiteboards

Leaflet Dispensers