EHR Practices

How should an independent practice choose and run an EHR?

An independent practice should choose an EHR by testing its own visit types, interfaces and billing flow, not a vendor demo script. Running it well means assigning owners for user accounts, results follow-up, interface errors and downtime, and keeping the HIPAA risk analysis and business associate agreements current.

What does a small practice need from the EHR on day one?

A small practice needs clinical and practice management functions to share one patient record. Hospitals split registration, charting and billing across departments; a practice of a few clinicians cannot staff those handoffs.

• Scheduling and registration: Visit types with the right slot lengths, online booking if the practice offers it, and insurance details captured once at registration.
• Eligibility before the visit: An X12 270/271 check run the day before or at check-in, so coverage problems surface while the patient can still fix them.
• Charting for the top visit types: Templates for the five or six visit types that make up most of the schedule, built with the clinicians who use them.
• Prescribing: NCPDP SCRIPT e-prescribing, plus electronic prescribing of controlled substances that meets DEA rules at 21 CFR Part 1311 if clinicians prescribe them.
• Orders and results: Lab and imaging orders out and results back into a results queue, with each abnormal result tracked to review and patient notice.
• Claims and payments: X12 837P professional claims built from the signed note, and 835 remittance posted automatically with denials grouped by reason code.
• Patient portal: Messages, results release, refill requests and forms, routed to staff pools rather than to one person's inbox.

A vendor scorecard for practice owners

Score each finalist on the same criteria, from 1 to 5, during scripted demos and reference calls. The scorecard below keeps the decision on evidence rather than on the best presentation.

• Visit fit: Give each vendor three of your real visit types, such as a new patient, a chronic follow-up with labs and an acute same-day visit, and count screens and clicks from check-in to signed note.
• Certification: Look up the product on the ASTP/ONC Certified Health IT Product List (CHPL) and record which criteria it holds, including the (g)(10) API and the (b)(10) data export.
• Interfaces: Ask for named, working connections to your reference labs, imaging center and clearinghouse, and for the cost of each one you would add.
• API and apps: Ask for the developer documentation, sandbox access and the terms for connecting a third-party app, including any write APIs the vendor offers.
• Exit: Ask for the export format and a sample file for a full practice export, and the contract terms for producing it.
• Downtime: Ask what staff see during an outage, and whether the schedule and recent notes can be printed or exported in advance.
• References: Speak to two practices of similar size and specialty that went live in the past two years, and ask what they would change.

Which obligations stay with the practice, not the vendor?

A cloud EHR moves servers to the vendor, not responsibility. The practice is the covered entity, and these duties stay with it.

• Risk analysis: The HIPAA Security Rule requires each covered entity to conduct an accurate and thorough risk analysis (45 CFR 164.308(a)(1)(ii)(A)), and the practice's own devices, Wi-Fi and staff habits are part of it.
• Activity review: 45 CFR 164.308(a)(1)(ii)(D) requires procedures to regularly review records of system activity, such as audit logs and access reports. The vendor keeps the log; someone in the practice has to read it.
• Business associates: A vendor that creates, receives, maintains or transmits PHI for the practice needs a business associate agreement (45 CFR 164.502(e) and 164.504(e)). HHS guidance adds that an app a patient chooses to receive their own records is not the practice's business associate.
• Right of access: Under 45 CFR 164.524, the practice must act on a patient's request for records within 30 days, with one 30-day extension if it tells the patient in writing.
• Information blocking: Health care providers are actors under 45 CFR Part 171. Delaying a patient's access to results or notes can be information blocking unless an exception applies.

How do you move a practice onto a new EHR?

A switch runs best on a fixed plan with named owners and a go-live date chosen around the practice's lightest weeks.

• 1. Decide what moves: Demographics, insurance, active problems, medications, allergies, immunizations and recent results as coded data; older notes and scanned documents as attached files or in a read-only archive.
• 2. Test the load: Load a sample of charts into the new system, and have a clinician compare twenty of them against the old system field by field.
• 3. Build templates and favorites: Configure note templates, order favorites and billing macros before training, so staff train on the system they will use.
• 4. Cut over interfaces: Switch lab, imaging and clearinghouse connections on a planned date, and keep the old system read-only so staff can look up history.
• 5. Train by role: Train front desk, medical assistants, clinicians and billing staff separately on their own tasks, with a super-user in each group.
• 6. Watch the first weeks: Each day, check unsigned notes, unreviewed results, failed prescriptions, unbilled visits and claim rejections until the counts stay low.

Routines that keep a practice EHR healthy

After go-live, the EHR needs a short list of routines with owners. In a small practice, the practice manager often holds most of them, with a named backup.

• Every day: Clear the interface error queue, check that every result has been reviewed, and work claim rejections.
• On every staff change: Create accounts with role-based access on day one, and disable the account on the person's last day. Never share logins at the front desk.
• Every month: Review access reports for unusual chart views, and review portal message volumes and response times by pool.
• Every quarter: Review templates and order favorites with clinicians, and remove fields nobody uses.
• Twice a year: Run a downtime drill using the contingency plan required by 45 CFR 164.308(a)(7), including printed schedules and paper forms.
• Every year, and when systems change: Update the risk analysis, check that every vendor handling PHI has a current business associate agreement, and confirm the data export still works.

Multi-factor sign-in is good practice for every user. The January 2025 HHS proposed rule would make it a requirement, but the current Security Rule requires person or entity authentication without naming a method.

How should a practice set up roles and access?

Set up access by role before go-live, then assign each person a role instead of building permissions one user at a time. Each role should see and change only what its tasks need.

• Front desk: Scheduling, registration, insurance capture, eligibility results and copay collection. Read access to the clinical chart is limited to what check-in needs, such as allergies flagged for the rooming staff.
• Medical assistants: Rooming, vitals, medication and allergy reconciliation, questionnaires and pending orders under standing protocols, with no ability to sign orders.
• Clinicians: Full chart access, order entry, prescribing, note signing and results review. Controlled-substance prescribing needs its own identity proofing and two-factor signing under DEA rules.
• Billing: Charges, claims, remittance and denials, with read access to the signed note that supports each claim.
• Practice manager: User administration, reports and settings, with every change to roles or settings logged.
• Emergency access: A documented break-glass procedure, which 45 CFR 164.312 lists as a required emergency access procedure, with every use reviewed afterwards.

Where small-practice EHR rollouts stall

• Hospital-length templates: Long review-of-systems blocks copied into a short office visit bury the assessment and slow every chart review.
• Scanned faxes as data: Outside results stored only as images cannot be trended, and staff end up typing values in by hand for billing.
• Templates per provider: When every clinician builds their own templates and charge macros, cross-coverage is slow and coding varies across the group.
• Apps added without review: A texting tool or scheduling widget that handles PHI for the practice, connected without a security review or business associate agreement, creates risk on day one.
• One person knows everything: When only one staff member understands the interfaces and settings, a vacation or resignation stops fixes until someone relearns them.
• Portal left unrouted: Messages that sit in an unwatched queue frustrate patients and delay care.

How Agnotic can help

A practice that keeps its EHR still needs the work around it done well. Agnotic Technologies builds that work for the practice: digital intake that files discrete data into the chart, lab and clearinghouse connections, SMART on FHIR tools for gaps the base EHR leaves, and chart migrations when a practice switches systems.

Agnotic builds against Practice Fusion, athenahealth, eClinicalWorks and other ambulatory EHRs through their documented APIs and HL7 v2 interfaces, so the practice keeps its vendor's upgrade path.

Sources

• ASTP/ONC: Certified Health IT Product List (CHPL)
• 45 CFR 164.308: HIPAA administrative safeguards
• 45 CFR 164.524: Access of individuals to protected health information
• 45 CFR 164.502: Uses and disclosures, including disclosures to business associates
• HHS: Health apps and HIPAA (access right, apps and business associates)
• 45 CFR Part 171: Information blocking
• HHS: HIPAA Security Rule notice of proposed rulemaking (January 2025)
• 21 CFR Part 1311: Requirements for electronic orders and prescriptions