Downtime & Business Continuity Procedure

Template for hospital adaptation • Caresoft eICU • Version: 1.1 • Effective: 01/04/2026

This is a template, not a finished procedure. Caresoft supplies it so that no site has to start from a blank page. The hospital must adapt every bracketed item, approve it through its own clinical governance process, and issue it as a hospital document. A completed, approved and issued downtime procedure is a condition of go-live under the Master Services Agreement §4.

Print it. A downtime procedure that only exists inside the system that is down is not a downtime procedure.

THE GOVERNING PRINCIPLE: bedside monitors, ventilators and their alarms are unaffected by any eICU platform outage.

Patient safety during downtime is maintained by bedside monitoring, bedside alarms and direct clinical assessment — exactly as it was before the Platform existed. Care must be able to continue safely and indefinitely without it.

Contents

Purpose and scope
Roles and contacts
Classifying the outage
Immediate actions — first 5 minutes
Scenario playbooks
Operating during downtime
Command centre during downtime
Documentation during downtime
Communication
Recovery and return to service
Reviewing the outage period
Planned maintenance
Extended outage
Downtime kit
Rehearsal and training
Downtime log

1. Purpose and scope

This procedure sets out what staff do when the Caresoft eICU platform, its data feeds, or the connectivity supporting them becomes unavailable, degraded or unreliable. It applies to all clinical, command centre, IT and biomedical staff in [units] at [hospital], at all hours.

It covers loss of the Platform. It does not replace the hospital's procedures for loss of bedside monitoring, loss of power, loss of the HIS, or major incident response, which remain in force alongside it.

2. Roles and contacts

Complete before issuing. Print and display in every clinical area and in the command centre.

Role	Name	Contact	Hours
Clinical Owner (accountable for clinical use)	[ ]	[ ]	[ ]
Technical Owner (infrastructure, devices)	[ ]	[ ]	[ ]
Charge nurse / shift in charge — [ICU name]	[ ]	[ ]	24×7
Command centre lead	[ ]	[ ]	[ ]
Hospital IT on-call	[ ]	[ ]	24×7
Biomedical engineering on-call	[ ]	[ ]	[ ]
Duty intensivist	[ ]	[ ]	24×7
Caresoft support — S1 critical	—	[24×7 phone]	24×7
Caresoft — patient safety (S0)	—	[24×7 phone] + [email protected]	24×7
Caresoft status page	—	[status URL]	—

3. Classifying the outage

Type	What you see	Data at risk?
A — Platform unreachable	Cannot sign in; portal not loading, all users	No — edge agents keep buffering
B — Site network / internet down	Platform unreachable from the hospital; devices and edge agents running	No, while buffer capacity lasts
C — Edge agent / gateway down	One or more beds show no sync; others normal	Yes — data from those beds is not being captured
D — Single device interface down	One bed or one parameter missing	Yes — for that device
E — ADT feed down	New admissions not appearing; rising quarantined count	No, but attribution is degraded
F — Degraded / unreliable	Slow, partial, stale values, or values that look wrong	Treat as most serious — see below
G — Command centre unavailable	Remote oversight lost; bedside unaffected	No

Type F is the most dangerous. A system that is clearly down is safe, because nobody trusts it. A system that is up but showing stale, partial or wrong data invites reliance.

If you suspect the Platform is displaying unreliable data, declare a downtime immediately and tell the unit to disregard the Platform. Do not wait for confirmation. It is always safer to run on the bedside unnecessarily than to trust a display that may be wrong.

4. Immediate actions — first 5 minutes

Any staff member noticing an outage

Confirm bedside monitoring is intact at every affected bed — display live, alarms enabled and audible, limits set. This comes before anything else.
Tell the charge nurse.
Do not attempt to fix the Platform yourself.

Charge nurse / shift in charge

Declare downtime verbally to the unit: "eICU is down — bedside monitoring and paper documentation from now."
Confirm every bed has working bedside monitoring with alarms enabled. Escalate any bed that does not as a clinical emergency under the hospital's monitoring failure procedure.
Confirm staffing. If remote oversight contributed to the staffing model, request additional bedside cover from [name/role] now.
Open the downtime kit (Section 14). Start paper observation charts.
Note the time downtime was declared. Start the downtime log (Section 16).
Notify: hospital IT on-call, command centre lead, duty intensivist, Clinical Owner.

Hospital IT on-call

Check the Caresoft status page and whether the outage is site-wide or Platform-wide.
Check hospital network, internet link, edge agent status and power.
Call Caresoft support on the S1 number. Phone, not email. State: hospital, unit, beds affected, when it started, what was tried.
If the Platform showed wrong or misattributed patient data, state that it is an S0 patient safety issue — this triggers a 15-minute response and evidence preservation.
Give the charge nurse an estimated restoration time as soon as you have one, and update every [30] minutes.

5. Scenario playbooks

Type	Clinical action	Technical action	Escalate at
A Platform unreachable	Bedside monitoring + paper. Command centre stands down remote oversight and informs units	Status page; call Caresoft S1	Immediately
B Network down	As A. Note buffer will hold data for approximately [x] hours	Restore link; confirm edge agents still running and buffering	Immediately; urgent if buffer limit is approaching
C Edge agent down	Affected beds on bedside + paper. Other beds continue normally	Check agent power, network, process; restart per runbook; call Caresoft if not resolved in [15] min	[15] minutes
D Device interface down	That bed on bedside + paper	Check cable, port, device output setting; biomedical to attend; check whether firmware or the device was recently changed	[30] minutes
E ADT feed down	Use manual admission entry so new patients are still tracked. Verify patient identity on every screen before interpreting data	Check HIS view/API; call Caresoft	[1] hour
F Degraded / unreliable	Declare downtime at once. Instruct unit to disregard the Platform entirely until cleared	Call Caresoft immediately; classify as S0 if any patient data may have been wrong	Immediately
G Command centre unavailable	Units continue on bedside. Restore the pre-eICU escalation path to the duty intensivist	Restore command centre access or relocate to [alternate location]	Immediately

6. Operating during downtime

Bedside monitoring and direct assessment are the sole means of detecting deterioration. Nothing else changes clinically.
Increase the frequency of direct observation to [hospital-defined interval] for patients whose oversight relied on remote review.
Escalate concerns by the pre-eICU route: [charge nurse → duty intensivist → consultant on call].
Do not silence or adjust bedside alarms to compensate for staff workload.
Continue to admit, treat and transfer patients normally. Downtime is never a reason to delay care.
Do not attempt workarounds — no photographing device screens for the command centre, no messaging patient data over personal channels.

7. Command centre during downtime

Absence of alerts is not absence of events. Loss of data flow is itself an escalation trigger.

On any loss of data flow, notify the affected units by phone that remote oversight is suspended. Do not assume they have noticed.
Record the time oversight was suspended and the time it resumed.
Where the command centre forms part of the agreed staffing model, its unavailability must be reported to [Clinical Owner] and additional bedside cover arranged.
Maintain a phone-based check-in with each affected unit at [interval] until service is restored.
Do not attempt to interpret partial or stale data during a Type F event.

8. Documentation during downtime

Use paper observation charts from the downtime kit, or the HIS if it is available.
Record: date, time with a clear 24-hour clock, parameter, value, and the name of the person recording.
Write times unambiguously. Avoid slash date formats entirely — use [DD-MMM-YYYY].
Retain every paper record. It is part of the medical record and must be filed even after transcription.
On restoration, transcribe into the Platform marked as retrospective, with the actual observation time and the time of entry both recorded.
Do not backdate entries to disguise that they were made retrospectively.

9. Communication

When	Who tells whom	How
On declaration	Charge nurse → unit staff	Verbal, whole unit
Within 5 min	Charge nurse → IT on-call, command centre, duty intensivist, Clinical Owner	Phone
Within 10 min	IT → Caresoft support	Phone, then ticket
Every [30] min	IT → charge nurse, Clinical Owner	Phone / [channel]
At shift change	Outgoing → incoming charge nurse	Handover, documented
On restoration	IT → all above	Phone / [channel]
Within 24 h	Clinical Owner → clinical governance	Written summary

Do not communicate patient identifiers over personal messaging during downtime. Use hospital-approved channels or the phone.

10. Recovery and return to service

Before standing down downtime, confirm all of the following:

Caresoft or IT has confirmed service is restored and stable.
Every bed shows a healthy sync indicator.
Spot-check at least [3] beds: does the Platform value match the bedside device right now?
Verify patient identity on each bed — confirm the right patient is shown on the right bed, particularly for any admission or transfer during the outage.
Buffered data has uploaded; check for remaining gaps.
Quarantined sample count is not rising.
Charge nurse and, for anything beyond a brief outage, the Clinical Owner authorise the stand-down.

Announce return to service to the whole unit and to the command centre. Record the time in the downtime log.

11. Reviewing the outage period

Buffered data arrives with its original timestamps and fills in the trend retrospectively. It may show deterioration that nobody saw live.

After restoration, a nominated clinician reviews the outage period for every affected patient.
Anything clinically significant found in backfilled data is escalated to the treating team immediately and documented.
Compare paper observations against backfilled data; investigate material discrepancies.
Where data is permanently missing (Type C or D), record the gap explicitly in the patient's notes — the record must show that data is absent, not merely be silent.

12. Planned maintenance

Caresoft gives at least [7] days' notice, normally scheduled [01:00–05:00 IST].
The Clinical Owner decides whether additional bedside cover is needed and informs affected units at least [48] hours in advance.
Request rescheduling for clinical reasons — surge, mass casualty, inspection — as early as possible.
Edge agents continue buffering throughout planned maintenance; no device data should be lost.
Run the return-to-service checks in Section 10 afterwards, even for planned work.

13. Extended outage

If downtime exceeds [4] hours, or is expected to:

Clinical Owner and Technical Owner take joint command and inform hospital executive.
Escalate to Caresoft L4/L5 per the SLA escalation matrix.
Formally review staffing for the next [24] hours and roster additional bedside cover.
Monitor edge buffer capacity. If the buffer limit is approaching, escalate as urgent — beyond that point device data is permanently lost.
Consider whether to pause any activity whose safety depends on remote oversight.
Brief families where the standard of monitoring described to them has changed, per [hospital communication policy].
Log the event as a clinical incident for governance review regardless of whether harm occurred.

14. Downtime kit

Kept in [location] in every clinical area and in the command centre. Checked [monthly] by [role]. Contents sealed and dated.

Printed copy of this procedure, current version.
Printed contact list (Section 2), current.
Paper observation charts — at least [24] hours for full unit occupancy.
Paper fluid balance, drug and clinical note sheets.
Blank downtime log forms (Section 16).
Pens. Clipboards.
Printed current bed–patient list, refreshed [each shift].
Printed escalation protocol.
Printed edge agent restart runbook (technical copy, command centre and IT only).

15. Rehearsal and training

Rehearse at least [annually] per unit, unannounced where safe to do so.
Include this procedure in induction for every new clinical user, before Platform access is granted.
Test that staff can find the printed kit and the contact list without using the Platform or a computer.
Record rehearsal date, participants, findings and actions. Feed findings back into the next revision.
Review after every actual downtime, and revise this document where the event exposed a gap.

16. Downtime log

Complete one per event. File with the unit's clinical governance records and send a copy to the Clinical Owner within [24] hours.

Field	Entry
Unit / beds affected
Outage type (A–G)
First noticed — date, time, by whom
Downtime declared — time, by whom
Bedside monitoring confirmed intact — time, by whom
Caresoft notified — time, ticket ref, severity
Additional staffing arranged? Details
Service restored — time
Return-to-service checks completed — time, by whom
Total duration
Data permanently lost? Which beds, which period
Backfilled data reviewed — by whom, findings
Paper records transcribed — by whom, when
Any patient affected? Incident report raised?
Problems with this procedure / kit
Completed by — name, role, signature, date