What Documentation Practice Is Required When Paper Forms Are Used During Downtime?

When paper forms replace a business or clinical system, document each action as a controlled transaction: identify the person or account, record the date and time, name the responsible employee, preserve the original, and reconcile every page back into the system after recovery. The paper packet is temporary—not an undocumented parallel system.

At 10:17 a.m. in a Merced urgent-care clinic, the electronic health record stops accepting logins in all three exam rooms. The medical assistant reaches for the downtime binder while a patient waits for a medication refill and a lab courier is already at the front desk. The clinician writes the patient’s identity, allergies, vitals, order, and follow-up instructions on paper.

The difficult decision is not whether to use paper. Care cannot simply stop. The decision is whether the clinic can later prove which patient received which order, who authorized it, when it happened, and whether the information made it back into the EHR without duplication or omission.

That is the narrow point of this article. A paper form is safe only when it is part of a documented workflow with an owner, a sequence, a secure holding location, and a reconciliation step. At Datapath, we help healthcare organizations in Merced, Modesto, Fresno, and the wider Central Valley turn that expectation into a tested operating procedure—not just a stack of blank forms.

What is actually required?

There is no single federal paper-form template that every organization must use for every outage. The defensible requirement is broader: maintain a documented contingency process that protects the confidentiality, integrity, and availability of information while critical work continues.

For a healthcare clinic, the HIPAA Security Rule requires procedures for emergencies that damage systems containing electronic protected health information. HHS describes that contingency planning as including backup, restoration of lost data, and continuation of critical business processes while operating in emergency mode.¹ The rule does not tell a Merced clinic exactly where to place a signature box. It does require the organization to make its process reliable enough to protect information and sustain essential operations.

HHS also says documentation required by the Security Rule must be maintained until six years after the later of its creation or the date it was last in effect.¹ That is not a blanket instruction to keep every clinical paper page for six years; it is a reason to distinguish the downtime policy, logs, approvals, risk assessments, and other required compliance records from the individual clinical record’s separate retention requirements.

For practical planning, the Office of the National Coordinator’s SAFER Contingency Planning guide recommends enough paper forms in each care area to support at least eight hours of care. It specifically identifies forms for orders and medication, laboratory, and radiology documentation, plus a process to enter and reconcile information after the EHR returns.² Treat eight hours as a planning floor, not as a universal legal deadline. A 24-hour clinic, emergency department, or multi-site practice may need more.

What should each paper form capture?

The form should make the later electronic entry and review possible without relying on memory. At minimum, design the packet and its instructions to capture:

• Patient, client, student, caller, account, or case identifier—using a temporary identifier when the normal system identifier is unavailable.
• Date and time of the event, not merely the date the form is eventually scanned.
• The name, initials, or authenticated signature of the person who recorded, ordered, approved, administered, released, or received the item.
• The action taken, including the order, result, disposition, approval, handoff, or exception.
• The source of the information and the person who verified it.
• A packet, encounter, transaction, or case number that links related pages together.
• A clear indication of whether the item is pending entry, entered, scanned, reviewed, corrected, or voided.
• Any deviation from the normal process, including a second verification or escalation.

These fields are not bureaucracy for its own sake. They answer the questions an auditor, supervisor, clinician, bank operations manager, or public-safety administrator will ask after the outage: What happened? To whom? When? By whom? Which system record now represents it?

The form should also prevent silent alteration. Use controlled, pre-approved forms; sequential packet numbers; a correction method that leaves the original readable; and a prohibition on erasing or discarding an erroneous page. If a mistake occurs, draw one line through the incorrect entry, add the correction, and initial and date it according to the organization’s policy. Do not create a clean replacement that hides the original.

How should a paper packet move from activation to closure?

A strong process has four distinct phases. Separating them prevents the common failure in which everyone knows how to start paper operations, but no one owns the return to normal.

1. Activate and issue

The downtime lead announces the event, records the start time, identifies affected systems, and assigns one person to control the paper supply. The custodian issues a numbered packet to a named department, room, teller, dispatcher, or caseworker.

The issue log should show the packet number, department, recipient, time issued, and expected return location. If the clinic issues packet M-0042 to Room 3, the log should not merely say ‘forms distributed.’ It should identify the employee who accepted custody.

This is also the point to decide whether the event is a normal outage or a suspected cyber incident. If ransomware or unauthorized access is possible, do not reconnect systems or upload paper records until the incident lead and technical team approve the action. Recovery and evidence preservation may have different requirements.

2. Record the work consistently

Each employee uses the approved form and follows the same identity and authorization steps used during normal operations as far as possible. Paper does not eliminate access control. A printed patient list, criminal-justice record, financial instruction, or employee file still needs a controlled location and limited access.

For a healthcare workflow, the medical assistant verifies identity before opening a downtime encounter, the clinician records the order and clinical decision, and the nurse or technician documents administration or specimen collection. For a finance workflow, the employee records the customer, transaction amount, approval path, callback verification, and temporary disposition. For a public-safety workflow, the dispatcher records the incident or query number, originating user, time, action, and any response received.

In a CJIS-regulated dispatch environment, the FBI’s CJIS Security Policy says that when an agency does not use an automated system, manual recording of activities must still take place.³ It also treats CJI protection as applying regardless of the form or method used to handle or disseminate it.³ A paper log is therefore not a way around accountability; it is the accountability mechanism when the automated one is unavailable.

3. Secure and hand off

At shift changes, the outgoing employee counts pages and packets, records the handoff, and places the material in a locked cabinet, controlled room, or other approved repository. Do not leave completed forms on a printer, in an exam-room trash bin, or in an unlocked dispatch tray.

The custodian maintains a simple status board or spreadsheet when safe to do so. It should show each packet as issued, in use, returned, under review, entered, scanned, or closed. If electronic tracking is unavailable, use a second paper control sheet. The process should never depend on one employee remembering which forms are still in a coat pocket.

4. Reconcile after recovery

When the system is available, do not tell staff to ‘catch up’ without a sequence. First confirm that the restored system is safe to use and that interfaces such as laboratory, pharmacy, billing, payment, or records systems are operating normally. Then establish an entry queue.

A practical queue might prioritize:

1. Safety-critical orders, medication administration, test results, and time-sensitive decisions.
2. New or temporary identities that must be matched to permanent records.
3. Transactions or approvals that affect money, legal status, public safety, or service eligibility.
4. Routine notes, scheduling, billing, and administrative work.

The person entering the item should compare the paper original with the electronic entry. A second reviewer should confirm high-risk items and mark the paper packet with the electronic record identifier and entry date. Scan pages that contain information not fully represented as structured data. If a paper order becomes coded data, retain the scanned or original document when policy requires it so the record preserves context and provenance.

The ONC SAFER guide specifically recommends a process for entering information recorded during downtime and reconciling it into the EHR, including coded entry and scanning content that is not otherwise entered.² That is the difference between data entry and reconciliation: reconciliation confirms that the electronic record is complete, belongs to the right person, and does not duplicate or contradict the paper source.

A downtime documentation decision matrix

Workflow stage	Minimum control	Evidence to retain	Owner
Activation	Record the outage start, affected system, and approving lead	Downtime event log and notification	Incident or downtime lead
Issue	Assign a numbered packet or controlled form to a named person or unit	Issue and custody log	Paper-form custodian
Work performed	Capture identity, date/time, action, authorization, and exceptions	Completed original forms and related attachments	Person performing the work
Shift handoff	Count pages and transfer custody explicitly	Handoff entry with outgoing and incoming names	Department supervisor
Recovery entry	Compare original to the electronic record and mark entry status	EHR or business-system identifier, entry date, reviewer initials	Designated reconciliation team
Closure	Resolve missing, duplicate, or conflicting items and approve disposal or retention	Exception log, reconciliation report, closure approval	Records owner and system owner

The exact names can vary. The controls should not disappear because the organization uses a different EHR, core banking platform, dispatch console, or student-information system.

How does this change by vertical?

Healthcare and clinics

Focus on patient identity, medication, specimens, orders, results, allergies, and handoffs. Temporary patient numbers must be reconciled to the correct permanent record. A paper packet should follow the patient or encounter—not simply remain in the room where it was created.

Finance, banks, and credit unions

Focus on transaction completeness and dual control. The FFIEC Business Continuity Management handbook identifies tracking daily transactions, reconciling general-ledger accounts, documenting operational tasks, posting entries after recovery, and maintaining backup records as possible continuity procedures. It also calls out manual steps for critical functions and documentation for timely posting after payment systems return.⁴

For a wire-approval outage, the paper record should connect the request, callback, approval authority, amount, release decision, and eventual system posting. A signature without the verification and posting trail is not a complete record.

Local government and public safety

Focus on case numbers, dispatcher identity, time stamps, dissemination, evidence handling, and later entry into the records-management system. If the form contains CJIS information, store it as sensitive information throughout its lifecycle. The chain of custody should be understandable to someone who was not present during the outage.

K-12 school districts

Focus on attendance, student identity, transportation, medication, emergency contacts, and the bell-schedule workflow. A paper attendance sheet should show the class, date, teacher, period, correction history, and eventual entry status. If a district’s student-information system is unavailable during dismissal, the paper process must also record who authorized a student release and when the electronic record was updated.

What should the procedure say about testing?

A policy that has never been exercised is an assumption. NIST’s contingency-planning guidance recognizes manual methods as an interim recovery approach and recommends documented recovery procedures, testing, training, exercises, and later reconstitution to normal operations.⁵

Test the documentation chain, not just the technology:

• Can a supervisor find the paper policy if email and the intranet are unavailable?
• Can staff identify which forms replace which system functions?
• Can the custodian account for every numbered packet?
• Can a new or temporary identity be reconciled without creating a duplicate record?
• Can a reviewer distinguish an original, a correction, a scanned copy, and a voided page?
• Can the organization produce the downtime event log and exception report for management review?

For a mid-market organization or a district with several sites, Datapath can help map these workflows to recovery objectives, define responsibility between the internal team and our named support team, and test the result through tabletop and live exercises. Our disaster recovery and managed cybersecurity services are designed around continuity and accountability, not an improvised help-desk response.

The Datapath standard: temporary paper, permanent accountability

The right question is not, ‘Do we have paper forms?’ It is, ‘Can we reconstruct every critical action taken while the system was down?’

For a clinic in Merced, that means protecting the patient record and reconciling every order. For a Central Valley county, it may mean preserving the dispatch and evidence trail. For a credit union, it means proving that every manual transaction was authorized, balanced, and posted. For a school district, it means knowing who released a student and whether the attendance record was corrected.

Datapath helps organizations document the decision points, assign ownership, secure the temporary record, and verify the return to normal operations. If your current downtime binder answers only how to print a form, it is not finished. Start with the workflow that would cause the greatest harm if one page went missing, and build the custody and reconciliation trail around it. Talk with our healthcare and clinics team or contact Datapath to turn that workflow into a tested, accountable procedure.

---

Footnotes

1. Summary of the HIPAA Security Rule | HHS.gov ↩ ↩²

2. SAFER: Contingency Planning ↩ ↩²

3. Criminal Justice Information Services (CJIS) Security Policy ↩ ↩²

4. BCM ↩

5. NIST 800-34, Rev 1 Contingency Planning Guide for Federal Information Systems ↩