When clinic systems go down, plan the return to safe work
A practical continuity exercise for independent clinics: protect essential work during disruption and account for unfinished tasks when systems return.
England: disruption can start with a supplier
A clinic can lose an essential service without losing its own computers. Laboratory results, prescriptions and communications may depend on organisations outside the practice. A continuity conversation should therefore include the people who provide those services, not just the company supporting the local network.
The NHS England Synnovis update published on 29 August 2024 recorded 10,104 acute outpatient appointments and 1,700 elective procedures postponed at two south-east London trusts since the attack began on 3 June. The latest reporting week ended on 25 August. These interim, unvalidated management figures describe one incident at two hospital trusts, not the probability of an outage at an independent clinic.
23 October 2026Reported postponements after the Synnovis attack
Two south-east London trusts · 3 June–25 August 2024
Agree the boundary of continued care
NHS England’s continuity toolkit recommends continuity arrangements for primary care, including collaboration over pathology or network failures and returning patient results. Its practical lesson for a clinic is to check dependencies with partners. It should not be presented as a universal legal rule for every UK private practice.
As a local planning exercise, list the services that could continue, those requiring an alternative pathway and those that must pause if essential information is unavailable. Have the clinical lead approve those boundaries. Name a deputy and agree how reception will obtain advice. The objective is safe, limited operation where appropriate, not keeping every appointment running at any cost.
United States: prepare staff for a different workflow
The US 2025 SAFER Contingency Planning Guide recommends available paper forms, reliable patient identification, staff training, communications independent of EHR infrastructure and orderly interface restart. It also calls for downtime information to be entered and reconciled after reactivation. These are safety recommendations; completing the guide does not establish HIPAA compliance.
For a small practice, turn those principles into a short walkthrough using fictional patients. Ask an administrator and a clinician to follow one request from arrival to completion without their usual screen. Where do they find the approved instructions? Who can answer an uncertainty? Record the obstacles they encounter rather than assuming a familiar paper form will explain the entire process.
Make outstanding work visible
Our editorial recommendation is a controlled downtime worklist with an identified owner. Its design should be approved locally and include only necessary information. Separate a task that has been received from one that has been reviewed or completed. Agree how handovers will work if the disruption extends beyond a shift, and how the temporary records will be protected.
For example, the exercise might reveal a request awaiting a result, a message awaiting clinical review or an instruction that has not reached the intended team. Decide who follows each item and how completion is confirmed. Avoid improvised personal messaging accounts or uncontrolled copies of patient records as a substitute for an approved communication route.
Reopening needs its own decision
A working login does not tell the team whether everything that happened during the interruption has been accounted for. Before the next exercise, agree a recovery checklist with clinical and technical owners: confirm the approved return to service, identify outstanding work, check for duplicate actions and assign the remaining reconciliation tasks. Keep a clear handover if recovery work cannot finish that day.
After the exercise, change one or two concrete weaknesses and repeat the affected steps. This is a suggested implementation approach, not evidence that a particular drill frequency guarantees safety. To discuss an administrative workflow with PRIS Care, request a demonstration using fictional data and ask what is currently supported. Keep continuity, security and suitability questions explicit rather than treating a demonstration as assurance.