Ambulatory Epic Downtime Planning: The Half Your Inpatient Plan Doesn't Cover
Downtime planning is inpatient-shaped — but clinics face invisible schedules, dark refill queues, and backfill at volume. The ambulatory plan, properly.
Ivan Ip, MD·5 min read·September 24, 2026
Read almost any downtime plan, attend almost any downtime drill, and you'll notice the same shape: it's an inpatient plan. Units, beds, census, the paper MAR. Ambulatory appears — if it appears — as an appendix: "and clinics will follow downtime procedures."
As a CMIO whose responsibilities span both worlds (and who still practices in one of them), let me make the case that ambulatory downtime has its own physics — different failure modes, different invisible populations, different backfill math — and that an inpatient plan with "and clinics too" appended will be surprised by exactly the things this post covers.
The different physics
Inpatient downtime is dramatic but legible: the patients are physically present, the census is walkable, the workflows are continuous and staffed around the clock. Ambulatory downtime inverts every one of those properties.
The schedule is invisible. A clinic's entire day — who's coming, when, for what — lives in Epic. When the system goes dark, the clinic doesn't just lose documentation; it loses knowledge of its own future. Patients arrive at their appointed times to a front desk that has no record they exist, no reason for visit, no context. Hundreds of times a day, at every location you run.
The queues go dark. Refill requests, patient messages, results awaiting review, referrals in flight — ambulatory medicine runs on asynchronous queues, and during downtime they don't pause; they accumulate invisibly. The refill a patient requested on day one of a six-day outage is a patient without their medication by day four, and nobody knows the request exists.
Results return to no one. Tests ordered before the outage keep resulting throughout it. Inpatient has a physical routing fallback — the unit, the chart, the walking pharmacist. Ambulatory results returning to a downed in-basket have no default physical path at all, and among them will be findings that cannot wait.
And nobody's drilled. Downtime exercises happen in hospitals. The clinic staff who'll improvise all of the above have, in most organizations, never rehearsed any of it.
The plan, clinic-shaped
Capture the schedule before you lose it. The single highest-leverage ambulatory readiness measure: scheduled, automatic export of upcoming clinic schedules — several days' depth, refreshed daily, stored where a downed network can't take them (this is exactly what offline-access infrastructure exists for; clinics need their own verified offline-access footprint, not a rumor that the hospital has one). A clinic holding yesterday's printout of the next three days' schedule is operational. A clinic without it is guessing at its own day.
Give the queues a downtime lane. Refills: a paper intake process at every clinic from hour one, with pharmacist or provider triage for urgency — because "we'll catch up on refills" is a patient-safety statement, not a workflow. Results: a named physical routing path (which fax, which printer, which staff member walks it to which clinician) and an escalation rule for criticals. Messages and referrals: a log, so the accumulating invisible work becomes visible, countable, and recoverable.
Close the inbound patient channels — deliberately, and early. The queues aren't merely going unread; they're still filling. Turn off patient portal messaging and turn off patient self-scheduling. A message sent into a downed In Basket is worse than a message never sent, because the patient believes they've reached you. A patient who self-schedules into a template nobody can see holds an appointment that exists only on their phone. Standard EHR cutover guidance makes the stakes concrete: you have to decide what happens to anything patients entered between your restoration point and the moment portal services were shut down — messages, questionnaires, medication requests — because that window can be lost outright. The same reasoning covers Fast Pass and automated appointment notifications, which standard guidance recommends turning off until backfill is complete.
The failure mode here is closing a channel without replacing it. Portal messaging is where patients raise symptoms, and some of those symptoms cannot wait. Every channel you disable needs a stated alternative and an explicit instruction for the concern that can't wait — a number a human answers, not a voicemail box that fills by noon. Decide in advance who holds the authority to flip these switches, because that's the same 2am problem as downtime activation itself.
Tell patients before they find out at your front desk. Publish the outage: a banner on your website, your social channels, the on-hold message, and signage at every clinic entrance. Draft that copy now, while you can think clearly about tone: what's down, what patients should do instead, when they'll hear from you next.
Decide the schedule question in advance. Extended outage, day three: does the clinic keep seeing its full template on paper, reduce to urgent visits, or selectively reschedule? There's no universally right answer — but there is a universally wrong process, which is every clinic deciding independently, daily, by improvisation. Pre-define the decision framework, the authority (regional? per-site? system?), and the patient-communication pathway that goes with it.
Build the clinic downtime kit. The inpatient downtime box, translated: visit documentation forms current with your ambulatory build, paper prescription workflow (with the security handling controlled-substance prescribing demands), registration forms meeting the identifier-capture standard, the refill and results logs, the phone tree, the schedule-export instructions, and the pre-drafted patient-facing notices. One standard kit, every site, on the same quarterly audit cadence as the hospital's cabinets.
The backfill math nobody runs
Here's where ambulatory ambushes the recovery: volume. Take your daily ambulatory encounter count — for many systems, a multiple of inpatient volume — times the outage days, every one needing an encounter matched or created, documentation entered, charges captured, and its queue-work (the refills granted on paper, the results reviewed by hand) reconciled into the record. Run the second-documentation-shift arithmetic I've laid out elsewhere with ambulatory numbers and the result is frequently the largest single line in the entire Tier 2 program — belonging to the setting the recovery plan mentioned in an appendix.
Two upstream levers shrink it, both familiar to readers of this series: visit forms designed backward from the Epic screens they'll be entered into (with identifier blocks and the downtime CSN on every page), and forms kept current with your ambulatory build — templates and flowsheets drift on the clinic side exactly as they do inpatient, with fewer people watching. Keeping that solved automatically, from your own Epic configuration, is precisely what Lumenly does — and clinics, with their thin administrative margins, are where manual form maintenance fails first.
The one-hour fix
Book an hour with your ambulatory operations leadership and walk four questions: How would each clinic know its schedule tomorrow if Epic died tonight? Where would a refill request go? Who would see a critical result? What paper would the visit be documented on, and does it match our current build? The answers will write your ambulatory chapter for you — and I'd wager at least two of the four produce silence the first time.