What should a GP practice do during a clinical system outage?

Treat the outage as a patient-care incident from the first minute

The appointment list is open, patients are waiting and the clinical system stops responding. A GP may not be able to see allergies, current medicines, test results or the reason for a booked review. Reception may lose access to appointment details. Prescriptions, referrals, results and online requests can continue arriving through different channels, or stop arriving without an obvious warning. The practice must work out what can be done safely now, who is responsible for each patient and how decisions made during downtime will be brought back into the record.

CQC's GP business-continuity guidance explicitly includes significant IT disruption among scenarios a practice should plan for. It expects a plan that identifies core functions, acceptable disruption periods, restoration routes, roles, contacts, communications and tests. NHS England's primary medical services guidance also describes a practice continuity plan that covers loss of access to patient records. The plan matters because an outage is a clinical information problem as well as a technical fault.

Call the named incident lead and clinical lead. Confirm the scope: one workstation, one site, the whole practice, a national supplier service, the network, telephony or a connected service. Record the time, affected functions and how staff discovered the issue. Start the approved continuity plan and contact the appropriate IT service desk or supplier through an authenticated route. A local restart or alternative workstation may solve a limited fault, but do not wait for repeated troubleshooting while urgent patients are left without a safe pathway.

This page owns a GP clinical-record system outage during active service. The hospital power-outage draft owns an acute-estate power failure and wider hospital service disruption. A GP telephone failure or alternative-site relocation may be a branch of this continuity owner if the patient and record workflow is substantially the same. The Complys general GP guide keeps broad CQC readiness. No draft or product statement here assumes Complys can operate as a clinical record during downtime.

Establish what information is still trustworthy

Ask which functions have failed and which may be stale. The appointment list may have been printed before new patients were added. A cached medication screen may not include an overnight hospital change. A referral status may display but fail to transmit. An online consultation queue may accept submissions while staff cannot see them. Do not describe the situation merely as “system down” when different functions have different risks. Make a short function map and update it when supplier information changes.

Separate access failure from data loss or suspected data integrity failure. If the practice cannot log in but the supplier confirms the data is intact, the main task is to deliver safe care and reconcile transactions after restoration. If entries appear missing, changed or assigned to the wrong patient, treat the data as potentially unreliable and escalate through clinical, supplier and information-governance routes. A clinician should not infer that a displayed value is current merely because one screen loads. The incident lead should record what has been checked and what remains uncertain.

Identify approved alternative information sources. A printout generated under the continuity plan, an authorised shared care record, a patient-held list or a direct call to another provider may help, subject to local access rules and clinical judgment. The patient can describe medicines or allergies, but memory may be incomplete. A screenshot on someone's personal phone is not an approved replacement record. Do not ask staff to create personal spreadsheets of patient details or send photographs of notes through informal messaging. When a lawful, approved information source is unavailable, the clinician must account for that uncertainty in the care decision.

Triage the patients already waiting

The clinical lead should decide which patients need assessment immediately, which can be seen with a documented information limitation, which can safely wait and which should be transferred or redirected. A person with urgent symptoms does not become a routine cancellation because the computer failed. Equally, a planned medicine review may be unsafe if the prescriber cannot verify the current prescription and recent results. The decision should be based on clinical need and the actual information available, not a blanket rule that all appointments continue or all appointments stop.

Give reception a clear escalation route for a patient who deteriorates in the waiting room or reports urgent symptoms by telephone. The triage team needs a way to call for clinical help while appointment systems are unavailable. Staff should know how to record the patient's name or identifier accurately without leaving sensitive information visible to others. If there is a queue of online requests that cannot be viewed, consider whether the practice must change its public message or contact the platform provider. Do not assume an inaccessible digital queue has stopped receiving requests.

Create a live list of affected patients and decisions in the practice's approved downtime format. Record the minimum information needed to manage care: patient identity, contact route, clinical owner, appointment or request type, triage outcome, follow-up task and where the full clinical note is kept. Keep it under controlled access. A pile of numbered paper sheets with no matching master list can lose a patient when shifts change. A master list without clinical notes can give false confidence that care has been documented.

Use downtime records that can be reconciled later

Follow the practice's approved paper or alternative digital downtime procedure. Every record needs reliable patient identification, date, time, author, clinical assessment, decision, advice, prescription or referral action and follow-up. Avoid unlabelled sticky notes. Use a unique identifier or a locally approved matching process so staff do not enter a consultation into the wrong record after restoration. If the practice has preprinted forms, check that they remain available off the failed system and are stored securely.

The clinician should document what information was unavailable and how the decision was made despite that limitation. If medicines, allergies or results could not be verified, say so and record any alternative check. A note that simply states “computer down, seen as usual” leaves the next clinician unable to understand the risk. If care is deferred, record the clinical reason, patient advice, safety-netting and who will rebook or review it. An apparently minor missing record can become a serious handover problem when a patient contacts the practice again later that day.

Keep a transaction log for work that normally moves through the system. This includes prescriptions, referrals, diagnostic requests, results received by another route, vaccination records, online requests and tasks sent to colleagues. Each item should have a named clinical owner and a later reconciliation step. Do not rely on memory to reconstruct dozens of transactions. A paper prescription may be possible under current local arrangements, but its use and later entry need prescriber and pharmacy process checks. This article does not give a universal prescribing workaround because those routes vary by system, contract and local clinical policy.

Protect confidentiality. Store paper records and downtime lists in a controlled area. Do not leave patient identifiers on open desks or use personal accounts to exchange files. Agree how records will move between rooms and shifts. If a patient is transferred, send necessary clinical information by an approved secure route and record what was shared. Information governance is part of the continuity response, not an administrative clean-up after the computers return.

Keep the identity check visible

During a busy outage, two patients with similar names may be on the list. Verify identity using the practice's approved process before consultation, prescription, specimen request or referral. Do not rely only on a seat number or a printed schedule that may be stale. If the system comes back intermittently, staff should know whether to use the paper process or the live system for each encounter. A mixed process without a cutover rule can create duplicate notes or missed tasks.

When a clinician uses a temporary note, mark its status clearly. It is an original clinical record that must be preserved, not scrap paper to discard after copying. Later transcription should identify the author, original time of care and time of entry according to the practice's record policy. If the later electronic summary differs from the original, the discrepancy must be resolved rather than silently rewriting the earlier account.

Manage prescriptions, referrals and test results deliberately

Prescribing may be one of the first services affected. A clinician may need to assess an urgent medicine need while unable to view the repeat list, allergy record, interactions or monitoring results. The clinical lead should define which prescribing activity can proceed under an approved alternative process and which needs additional verification or deferral. Make pharmacy and patient communication clear. Do not promise an electronic prescription has reached a pharmacy if transmission is uncertain. Track each issue until the receiving service confirms the handover where appropriate.

Referrals need a similar sender-to-receiver check. If an urgent referral is written outside the usual system, record the receiving service, method, time sent, content and confirmation or escalation. A draft on a local computer is not a completed referral. A referral entered after restoration may duplicate one sent by another route, so the transaction log must show what has already happened. Where a patient must attend urgent care immediately, the clinician should use the appropriate emergency pathway and direct communication rather than waiting for an electronic form to reopen.

Results are particularly vulnerable to split channels. A laboratory may continue to produce urgent results and use telephone or secure email while the usual inbox is unavailable. Assign someone to receive, log, clinically review and act on such communications. When the system returns, reconcile the temporary result log with the electronic inbox. The GP test-results backlog draft owns the resulting queue or missing-result investigation. This page covers the outage and its temporary result pathway. The two owners should link because recovery is incomplete if a critical result is stranded in one channel.

If specimen collection continues, label and transport processes still need a safe order-to-result trail. A handwritten request that cannot be matched to the patient or clinician can generate a different incident after the system is restored. Use approved local laboratory downtime instructions. Record what was sent, how it was identified and who will check that a result returns. If these steps cannot be met, the clinical lead should decide whether non-urgent testing must pause and how urgent testing will be arranged.

Communicate one consistent service position

Staff, patients and partner services need a current message. The incident lead should tell reception and clinicians which services continue, which are restricted, where urgent patients go, and when the decision will be reviewed. Update the website, telephone message or digital access route through approved channels if the outage is prolonged or online requests are not being seen. Avoid a public message that suggests emergency symptoms should wait for the system to recover. Give a clear urgent-care route that fits local NHS arrangements.

Contact the relevant commissioner, NHS support team, system supplier and neighbouring services according to the practice plan and the scale of the incident. A single-site fault may be handled locally; a national supplier outage may need coordinated advice. Do not make an informal transfer to another practice without agreed clinical, record, capacity and patient communication arrangements. CQC's continuity guidance highlights collaboration and communication, but the exact partner list and trigger should be set locally.

Keep an incident timeline. Record significant changes in supplier status, patient risk, service restrictions and external advice. If the outage lasts longer than anticipated, revisit the clinical decision instead of letting the first hour's workaround run all day. Staff fatigue, a growing paper backlog and new urgent cases can change the risk. Set review times and hand over responsibility at shift change. The same incident may need different arrangements for morning appointments, afternoon visits and overnight cover.

Restore service in stages, then reconcile every channel

Technical access returning is the start of recovery, not the end. Confirm with the supplier or local IT team which functions are stable and whether any data may have been lost or delayed. Test login, patient search, consultation entry, prescribing, referrals, results, task queues and communications relevant to the practice. A green status page does not prove every interface has caught up. Ask staff to report failed transactions or mismatched records rather than retrying silently until a duplicate appears.

Set a controlled cutover time. Tell all teams when new consultations return to the live system and how to finish encounters already started on paper. Nominate people to enter or scan downtime records, reconcile prescriptions and referrals, and review incoming results. They need protected time and a checker for high-risk items. Keep a record of which entries have been reconciled and which remain open. Do not close the incident when clinicians can log in while an unreviewed stack of clinical notes remains in a drawer.

Reconcile by patient and task, not merely by document count. Did every patient seen during downtime receive a complete record in the right chart? Was every medicine issue sent, collected or cancelled as intended? Did each urgent referral reach the receiving service? Were telephone results actioned and later matched to the electronic result? Did online requests submitted during the outage become visible, or are they still in a delayed queue? Use the transaction log and supplier information to answer these questions. Escalate any unmatched item to a clinical owner until resolved.

Check for double work. A patient may have been given a paper prescription and then receive an electronic one. A referral sent by secure email may later be re-sent through the standard pathway. Duplicate actions can cause harm as readily as missed actions. Record which route was used, confirm status with the recipient when necessary and cancel or explain a duplicate through the appropriate clinical process. Keep an audit trail of any correction. Never delete an original record solely to make the reconciliation list look tidy.

Test the continuity plan against what happened

After the immediate backlog is controlled, review the outage with reception, clinicians, IT, medicines and information-governance leads. Identify where the plan worked and where staff improvised. Were offline contact numbers current? Could staff access the paper forms? Did everyone know who could restrict clinics? Could urgent results reach a clinician? Did the patient message match the service actually available? Assign each improvement an owner, due date and test. The incident corrective-action draft explains how to verify that a change has prevented recurrence.

Test the revised process in a short exercise before the next real outage. An exercise can start with “the record system is unavailable at opening” and ask one clinician, one receptionist and one manager to walk through a patient consultation, urgent prescription and result receipt. Check the actual forms, contact routes and access permissions. A continuity plan that exists only on the system that has failed is not available when needed. CQC expects plans to be accessible on and off site and tested for learning.

Record the patient safety and notification decision

NHS England's policy guidance on recording patient safety events states that digital technology incidents can be patient safety events when they affect, or could affect, clinical decisions or care. It explicitly includes electronic patient record downtime and says activation of continuity processes can warrant recording even when harm has not occurred. The practice should use the applicable local and national reporting route after confirming scope. Do not use “no reported harm” as a reason to ignore an outage that created a plausible patient safety risk.

A CQC notification is a separate question. CQC GP mythbuster 21 explains the events and service disruptions that may need notification under the registration framework. Assess the actual impact and current notification criteria with the provider's governance lead. This article does not claim every short IT outage must be notified to CQC. If personal data has been exposed, lost or misdirected, the information-governance lead must assess the incident under the applicable data-protection and NHS reporting rules as well. Patient safety, data protection and CQC notification are related but distinct decisions.

Preserve the timeline, supplier incident references, service decisions, affected patient list, temporary records, reconciliation evidence and final review. Restrict identifiable information to approved clinical and governance systems. A short summary can state the interruption, main control, learning and closure without storing patient details in a general task. The record should let a reviewer follow how the practice protected patients and restored complete information, rather than showing only that a supplier ticket was closed.

Use Complys for governance evidence within its actual scope

The Complys GP and clinic page describes the platform as a compliance layer alongside clinical and patient-record systems. Subject to actual configuration, a practice could use it to hold a continuity-plan review date, assign exercise actions, track supplier and incident evidence, and follow corrective actions after recovery. It should not be presented as a substitute clinical record, an offline prescribing system or an automatic route for patient results. Its availability during a particular clinical-system outage also has to be checked rather than assumed.

Design the evidence boundary before using a compliance task. A task can identify the incident owner and whether reconciliation is complete. The patient-level list, clinical decisions and consultation notes should stay in approved clinical or restricted incident systems. If the general task points to a restricted record, check permissions and retention. The practice must still test its actual communications and downtime tools in advance. Software reminders cannot supply patient history when the patient-record system is unavailable.

A practical recovery sequence

Use the following sequence as a prompt for local procedure, with clinical judgment at each step:

The plan must be usable when network access is lost. Keep approved offline copies of the critical action cards and contact details in a secure place staff can reach. Recheck them when suppliers, staff or services change. A practice with several sites should decide which site can provide which care during an outage and how the patient record will follow. The arrangement must be agreed and tested, not assumed from proximity.

CTA: Review how Complys can track your GP continuity plan, exercise evidence and corrective actions, with patient-level care kept in approved clinical systems. Ask for a walkthrough against a real outage scenario. Related tool opportunity: A controlled GP system-outage action card and reconciliation checklist. Test it with local clinical, IT, information-governance and commissioner processes before release. Internal links out: GP test-results backlog; hospital power-outage response; incident corrective-action effectiveness; GP emergency-kit opening failure. Internal links in proposed: Broad GP CQC guide, GP test-results owner and future GP patient-safety alert owner after route review.