When an EMR vendor shuts down, its obligations end and yours do not. Medical record retention requirements attach to the practice under state law and payer rules, typically for six to ten years and longer for minors, and they survive the vendor that hosted the records. If a vendor fails with the only copy of your charts, the practice owns the consequences: the compliance gap, the continuity-of-care problem, and the malpractice exposure of an unproducible record. The good news is that every part of this risk can be contracted around before signing, and most of it can be managed even late, if you move before the servers go dark.
The uncomfortable truth
Buyers tend to assume that patient data in a commercial EMR is safe because the vendor is a real company with real customers. The assumption fails on two fronts.
First, the data sits on infrastructure someone must keep paying for. When a company enters wind-down, hosting bills stop being paid on a schedule you do not control and were never told about. Practices affected by health-IT shutdowns have historically received windows measured in weeks, sometimes days, to retrieve years of records.
Second, bankruptcy changes who you are dealing with. Once a vendor enters bankruptcy, its assets, which can include its servers and its customer contracts, come under a trustee's control, and the trustee's duty runs to creditors. Your business associate agreement still binds whoever holds the PHI, but the practical experience of extracting data from an estate in liquidation is slow at exactly the moment you have no time. Planning that depends on a failing vendor behaving well is not planning.
How shutdowns happen
Outright bankruptcy is the dramatic case and not the common one. The shutdowns that catch practices out usually look like one of these:
- Acquisition and sunset. A larger vendor buys the company and announces end-of-life for your product line, with a migration offer to its own platform. You get a deadline and a sales pitch, and the migration to the acquirer's product is priced and scoped on their terms.
- Quiet abandonment. The company survives, and your product stops receiving meaningful updates. Certification lapses, defects accumulate, support thins out. There is no notice letter, just decay.
- Divestiture. Your contract is sold to a company you have never evaluated, with a different support organization, a different roadmap, and sometimes a different country's data practices.
- True failure. The company runs out of money and stops operating, sometimes with little warning. The smaller and more specialized the vendor, the more real this scenario is.
Each variant creates the same buyer need: the unilateral ability to take a complete, usable copy of your data and leave.
The four clauses that protect you
| Clause | What it must say | What weakens it |
|---|---|---|
| Data export right | You may export all your data, at any time, in a documented format, without per-export fees that make exercise punitive | "Upon termination" only; proprietary formats; export priced per record |
| Wind-down / transition assistance | On termination or discontinuation, vendor provides migration support for a defined period at defined rates | No defined period; "commercially reasonable efforts" with no specifics |
| BAA return-or-destroy | At termination, PHI is returned in usable form or destroyed with certification, per the BAA's termination provisions | Return obligation with no format or timeline; destruction with no certificate |
| Escrow (higher-stakes deployments) | Data (and for on-premise, source code) held by a third-party escrow agent, releasing on bankruptcy, discontinued support, or failure to cure | Escrow that is never verified or updated; release triggers that require litigation to invoke |
The export right does the most work, because it is the one you can exercise on suspicion rather than on proof. A practice that runs a full export quarterly has converted the shutdown scenario from a crisis into an inconvenience. Certified EHRs are required to support electronic export of patient data as part of ONC certification, and the ONC Certified Health IT Product List shows whether your product's certification is being maintained, which doubles as a health check on the vendor itself.
Warning signs a vendor is in trouble
Vendors do not announce distress; they leak it. Watch for:
- The release notes go quiet. A healthy EMR ships updates constantly, for regulatory changes if nothing else. Slowing releases are the single most visible leading indicator.
- Certification maintenance lapses. Check the product on the CHPL periodically. A vendor that stops investing in certification is signaling where it is cutting.
- Support degrades. Response times stretching from hours to weeks means the support team is shrinking.
- Key people leave. A founder exit plus a head-of-engineering exit inside a quarter is worth treating as information.
- Pricing behavior turns strange. Deep sudden discounts suggest a company buying revenue to survive; steep sudden increases can be an acquirer harvesting a product it intends to sunset.
- The corporate entity changes. Invoices or legal notices from a name you did not contract with mean your agreement has moved, and your protections travel only as written.
Any two of these together justify running a precautionary full export and rereading your termination clauses the same week.
The playbook when the notice arrives
If a shutdown or sunset notice lands, in order:
- Export everything, immediately. Full patient records, documents and attachments, schedules, and billing data, before negotiating anything. Capacity and support both degrade as the deadline approaches, so the practices that move in week one get clean exports and the ones that move in the final week compete for a shrinking help desk.
- Read the BAA and invoke it in writing. The return-or-destruction provision is your legal hook for a complete copy in usable form. Put the request in writing early; paper trails move estates and acquirers in a way phone calls do not.
- Confirm retention coverage. Whatever system you move to, the exported records must remain producible for your full state retention period. A decommissioned system's data that you still hold remains ePHI, with everything that implies for safeguarding it.
- Select the successor deliberately, even under time pressure. A forced migration is still a migration. The concerns in switching EMR systems without losing data all apply, compressed.
- Verify the copy before the source disappears. Spot-check migrated charts against the export, and keep the raw export archived even after the new system is live. It is your proof of what existed.
The questions to ask before you sign
Vendor failure is a buying-stage problem, which is why this article sits in Costs & Contracts. Alongside the broader review in how to read an EMR contract and the ownership analysis in data ownership and exit clauses, put these to every finalist:
- Can we export all of our data ourselves, today, without a services engagement? In what format, and is the format documented?
- What exactly happens to our data if you discontinue the product, are acquired, or cease operations? Show us the contract language, not the reassurance.
- What did your last three sunsetted or migrated customers experience, and will you connect us with one?
- Is your certification current on the CHPL, and who is responsible for keeping it current?
A vendor with good answers will produce them quickly, because other buyers have asked. A vendor that treats the questions as hostile has answered them anyway.