Houston Medical Practice Downtime Plan: Can You Run 15 Days on Paper?

What the 65 hospital attacks broke, and what each kind of disruption means for a Houston practice.

A Houston practice should size its downtime plan for 15 days because that was the median clinical system outage across hospital cyberattacks from 2022 to 2026, according to The Health Management Academy. In 89% of the 65 attacks it logged, electronic records or clinical systems went offline and staff worked on paper.

Paper was the near-universal result. The other disruptions were less common but still frequent: 43% of attacks canceled or postponed surgeries, treatments or appointments, 40% diverted ambulances, and 15% closed clinics or departments. One attack often caused several, which is why the shares add to more than 100%.

Each hospital disruption has a practice-sized version. Records on paper means no chart history, no e-prescribing and no claim submission. Canceled appointments mean lost revenue and patients who need a call. A diverted ambulance becomes a referral the practice cannot send, or a lab result it cannot receive. A closed department becomes a closed office, which is what happened to the Mississippi clinics.

Do not read the federal breach portal as a measure of this risk. The Academy matched its 55 attacks at least a year old against the HHS breach registry and found 12, or 22%, with no related filing at all, because the registry counts exposed patient records and has no field for disrupted care. An attack that takes a practice offline for two weeks without stealing data may never appear there.

The five steps, in the order a Houston practice should build them, each sized for a 15-day outage.

A practice downtime plan has five steps: rank the systems the practice cannot work without, print a paper kit for each, keep a backup copy an attacker cannot reach, decide in advance how each day's patients are handled, and drill the whole plan twice a year. Each step should assume the outage lasts 15 days.

Step 1: Rank the systems you cannot work without

List every system the practice touches in a day: the EHR, practice management and scheduling, e-prescribing, the clearinghouse, imaging, the lab interface, phones and email. Rank each by how long the practice can work without it. Scheduling and the phone system usually sit at the top, because without them nobody knows who is coming or can tell them not to.

Step 2: Print the paper kit before you need it

For each top-ranked system, build the paper version and store it where staff can reach it without a computer: blank encounter forms, a printed schedule for the next three days refreshed every evening, a printed patient phone list, paper prescription pads where state rules allow, and a one-page call tree that names who decides what. A kit that has to be printed after the attack cannot be printed.

Step 3: Keep a copy the attacker cannot reach

Ransomware encrypts what it can reach, and that usually includes backups on the same network. The copy that saves a practice is immutable, meaning it cannot be changed or deleted for its retention period, and stored offsite. Know which systems your EHR vendor hosts and restores for you, and which ones sit on your own server or in your Microsoft 365 tenant and are yours to restore.

Step 4: Decide each day's patients in advance

Write the triage rule before the outage, not during it: which visits go ahead on paper, which are moved, and which are referred elsewhere. Day 1 is the hardest, because the morning's patients are already in the parking lot. Name the person who makes the call, and give the front desk a short script for the patients who are moved.

Step 5: Drill it twice a year

Run a two-hour drill where the front desk and one provider work a mock schedule on paper only. Time how long check-in takes, find the form nobody printed, and fix the call tree. Then plan the back-entry of paper notes into the record, because day 15 is when two weeks of paper has to go somewhere.

The five steps take a practice from a vague hope that the EHR comes back by lunch to a written answer for day 1, day 3 and day 15. A plan that covers the 41-day longest outage is better still, but a plan that covers the 15-day median is the one to build first.

How the five steps line up with the five parts of 45 CFR 164.308(a)(7).

The HIPAA Security Rule already requires a downtime plan. The contingency plan standard at 45 CFR 164.308(a)(7) has three required parts, a data backup plan, a disaster recovery plan and an emergency mode operation plan, plus two addressable parts: testing and revision, and an applications and data criticality analysis.

The emergency mode operation plan is the part a backup does not cover. The rule asks for procedures that keep critical business processes running while protecting electronic protected health information during emergency operations. That is a paper kit, a triage rule and a call tree, written down. A backup alone answers the data backup plan, and nothing else.

The five steps map onto the standard one to one. Ranking the systems is the criticality analysis. The paper kit and the triage rule are the emergency mode operation plan. The offsite, immutable copy is the data backup plan, and restoring from it is the disaster recovery plan. The twice-yearly drill is testing and revision. A practice that builds the five steps has a contingency plan it can show, and a HIPAA compliance review that asks for one gets a document instead of a promise.

"Addressable" does not mean optional. Under the HIPAA Security Rule, 45 CFR 164.306(d)(3) says an addressable specification is implemented if it is reasonable and appropriate; a practice that decides otherwise documents why and implements an equivalent alternative where reasonable. For a practice whose EHR is the business, testing the plan is hard to argue away.

Why a Houston practice needs a plan for outages in systems it does not run, starting with the hospital it refers to.

Texas recorded more hospital-touching cyberattacks than any other state in The Health Management Academy count, 7 of 93 state counts from 2022 to 2026. A Houston practice that refers patients, sends labs or reads images through a hospital system needs a downtime plan for that system's outage as well as its own.

A practice's own server can be healthy while its work stops. Referrals, lab orders and results, imaging reads, claims and hospital-hosted record access all run through systems the practice does not own. When one of them goes down, the practice is on paper for that workflow even though nothing in its office was attacked. The University of Mississippi Medical Center outage shows the pattern at full scale: one attack on the health system's record closed 35 clinics until March 2.

Map these dependencies the same way as Step 1, then write an alternate for each one: a second reference lab, an independent imaging center, a phone or fax route for referrals, a backup way to check eligibility, and the hospital's own downtime contact. Practices in Katy, Sugar Land and The Woodlands that send work into the larger Houston hospital systems should collect those contacts now and print them into the call tree.

Drill the whole plan twice a year on fixed dates, for example alongside each HIPAA risk review, rather than waiting for a quiet week. A busy practice never has one, and the drill is where the missing form, the stale phone list and the lab nobody has an account with turn up.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

For healthcare and dental practices, CinchOps covers the technical half of the downtime plan so the practice can own the clinical half. The pairing below shows where each step meets a CinchOps service.

• The ranked system list comes out of CinchOps vCIO services, including which systems your EHR vendor restores and which are yours.
• Immutable, verified offsite copies of servers, laptops and Microsoft 365 come from backup and recovery, stored outside the Gulf Coast flood zone.
• CinchOps cybersecurity services run 24/7 threat monitoring, so an attack is caught at the first sign rather than at the first locked screen.
• With VoIP phone systems, the practice can forward the main line to cell phones, so patients can still reach the front desk when the office network is down.
• CinchOps signs a business associate agreement with healthcare clients and supports HIPAA compliance work across Houston and Katy, with help desk requests answered in under 15 minutes through managed IT support.

A small office does not have to take 15 days to recover. With a ranked system list, verified backups and CinchOps restoring the EHR, phones and billing first, a smaller practice can be back on its own systems much sooner than a hospital system. The plan still assumes the long outage, so the practice keeps seeing patients on paper while CinchOps works the recovery as fast as it can.

A downtime plan is the difference between a hard two weeks and a closed practice. If your plan today is a backup and a hope, start with the paper kit and the call tree this week, then talk to CinchOps about the rest.