A medical practice backup internet connection can help maintain access to cloud-based clinical tools when the primary service fails. But buying a second connection alone does not ensure continuity. The backup must be able to take over, support the practice’s essential workflows, and be tested in a controlled way.
The right plan depends on how your practice uses internet-connected systems, what interruptions would affect patient care, and how quickly staff need to resume work. A thoughtful test checks more than whether a router switches connections. It confirms whether the systems and processes your team relies on are usable on the alternate path.
Does HIPAA require a backup internet connection?
HIPAA contingency planning concerns the availability of systems that contain or use electronic protected health information. It does not, by itself, prescribe that every practice purchase a second internet service. The SAFER Guide on contingency planning can help practices consider how to prepare for disruptions. Your connectivity decisions should fit your risk assessment, operating needs, and broader contingency plan.
For a practice that depends on a cloud EHR, telehealth, electronic prescribing, patient communications, or hosted phone systems, a loss of internet may affect several workflows at once. A backup connection may be worth evaluating when downtime would significantly interrupt care or operations. It is one possible resilience measure, not a substitute for documented downtime procedures, secure systems, or staff preparation.
Decide what needs to work during an outage
Before choosing a connection or testing failover, identify which services are essential and what staff should do if any of them are unavailable. Consider the clinical and administrative tasks your practice needs to continue, which can wait, and which require a documented downtime process.
- Clinical systems: Determine whether authorized staff need access to the EHR, scheduling, patient records, or other cloud-based tools.
- Patient care and communication: Consider telehealth, secure messaging, and the phone system. Internet-based phones may be affected by the same outage, so plan an alternate way to communicate.
- Administrative work: Identify essential billing, payment, and office coordination tools, along with tasks that can safely be deferred.
- Security and access: Confirm that the backup path supports approved secure connections and authentication. Do not ask staff to bypass security controls to get online.
For an outage procedure focused on check-in and front-desk tasks, see this guide to EHR downtime and patient check-in workflows. If internet-based phones are part of your operation, review the separate guidance on clinic phone service during an internet outage.
Choose a backup that adds real resilience
A secondary service is useful only if it can carry traffic when the primary service is unavailable. Ask your IT support team and providers how the alternate connection is delivered and whether it depends on the same physical route, equipment, or local infrastructure as the primary connection. Two service plans may still share a point of failure.
Also consider the backup technology’s availability at your location and whether it can support the applications and number of users that need access. A cellular connection may be an option in some settings, but usable coverage and performance at the practice should be confirmed rather than assumed.
Check the network equipment and power path, too. If the modem, router, or other required equipment loses power, an alternate internet service may not help. Include power needs in your continuity planning, and have IT confirm that the network is configured to switch connections as intended. A review of your medical office network can help surface dependencies that a second service plan alone may not address.
How to test internet failover safely
Plan a controlled exercise with your IT support team before an actual outage. Choose a time and scope that reduce the chance of interrupting patient care, notify the staff involved, and agree on how to stop the test if an unexpected issue arises. Do not disconnect equipment or change network settings without appropriate technical support.
- Set the test goals. List the workflows you intend to check, the staff who will verify them, and the results you need to record. Confirm that the exercise will not expose patient information or weaken security.
- Record the starting condition. Confirm that the primary connection and agreed-upon systems are working before the test. Note any active sessions or work that should not be interrupted.
- Simulate loss of the primary connection. Have IT perform the agreed test so the configured failover can take place. Observe whether the backup activates and record any delay or alert.
- Check real workflows. Have designated staff confirm access to the EHR and other agreed essential tools. Test the relevant secure connection, telehealth, and phones if those are in scope. A connection indicator or speed test alone cannot confirm that staff can complete these tasks.
- Check for limitations. Note slow responses, dropped sessions, applications that require a fresh sign-in, or services that remain unavailable. Some disruptions may be with a vendor or cloud service rather than the practice’s internet connection.
- Return to the primary connection deliberately. Ask IT to carry out the planned recovery or failback. Confirm that systems remain usable and identify any interrupted, duplicated, or queued work that needs staff review.
- Document and follow up. Record what was tested, what worked, what failed, and who owns each corrective action. Update staff instructions and schedule another test after meaningful network or workflow changes.
Prepare for a failed backup or power loss
Failover is not a complete outage plan. Staff should know how to report a connectivity problem, who can authorize downtime procedures, and how to communicate if the normal network and phone systems are unavailable. Keep the instructions accessible through a method that does not depend on the affected connection.
Practice-specific downtime forms and procedures should explain how staff will handle essential work, protect patient information, and reconcile records after systems return. When service is restored, review transactions or tasks that were interrupted or queued before treating the outage as resolved.
For practices in the area, the St. Johns County Emergency Management page is a local resource to consider as part of broader emergency planning. Connectivity planning should also account for the possibility that a local disruption affects internet service and power at the same time.
Frequently asked questions
Does HIPAA require a medical practice to have a second internet provider?
HIPAA contingency planning does not prescribe a second internet provider for every practice. Evaluate whether a backup connection is an appropriate measure for your systems, risks, and continuity needs, and maintain procedures for outages either way.
How can we tell whether the backup provider is independent?
Ask the providers or your IT team whether the services share physical routes, equipment, or other infrastructure that could fail together. Confirm the details for your specific location rather than relying on the fact that the services have different names.
Is a speed test enough to prove failover works?
No. A speed test can offer a limited connection check, but it does not prove that staff can access the EHR, telehealth, phones, or other essential tools. Include workflow checks in a controlled test.
What if the backup connection or power also fails?
Follow the practice’s downtime and communications procedures, use approved alternatives, and prioritize patient safety and information security. Include IT support in recovery, then review work that was interrupted when systems return.
Make the backup part of a tested plan
A second connection can support continuity when it is appropriately designed and verified against the work your practice needs to perform. Map essential workflows, check for shared points of failure, and test failover and recovery with IT support. To discuss network resilience and healthcare IT planning for your practice, contact Zevonix at (904) 658-0777.