eClinicalWorks Hosting: What Clinics Should Ask Before Signing

When your EHR goes down, your clinic stops seeing patients. Billing stops. Compliance clocks start ticking. If you are evaluating an eClinicalWorks hosting arrangement, whether for the first time or at contract renewal, the questions you ask before signing will determine who is on the hook when that happens.

Most practice managers are not IT professionals, but they are the ones signing the hosting contract. That means you need to know what accountability looks like in writing, what happens to your data if the vendor fails, and who picks up the phone at 2 a.m. The nine questions below are what to bring to any hosting vendor conversation.

Question 1: Who has signed a Business Associate Agreement with us?

Under HIPAA, any cloud service provider that creates, receives, maintains, or transmits electronic protected health information (ePHI) on your behalf must have a signed Business Associate Agreement (BAA) in place.

eClinicalWorks does sign BAAs. For new customers, the BAA is included in the Master Services Agreement signed during implementation. Existing customers can request the latest BAA template from their account manager or compliance team.

But here is what matters: you need the BAA in writing before any patient data moves to the new host. Ask your hosting vendor for their BAA too. They are a business associate of your clinic, and they need to be named in the agreement. Do not move forward without it.

Question 2: What is the uptime guarantee, and what happens when it is missed?

Ask for the uptime percentage in writing. Ask what happens when it is missed, is there a credit, a refund, or nothing? Ask how the vendor defines "downtime." Does it include planned maintenance? Does it start when the system goes down or when the vendor is notified?

This matters because the CMS Emergency Preparedness Rule applies to clinics and other outpatient provider settings, and your hosting plan is part of your disaster recovery obligation. If your vendor cannot tell you their uptime guarantee in writing, that is a red flag.

Question 3: How is our data actually backed up, and can we restore it?

eClinicalWorks runs on open MySQL databases. Standard internet-based backup products often do not properly capture live MySQL data. You may think your data is backed up when it is not.

Ask your hosting vendor to walk through exactly how their backup handles open MySQL databases. Ask how often they test restores. Ask how long a restore takes. Ask them to put the backup methodology in writing. If they cannot explain it clearly, do not sign.

Question 4: Where does our data live, and who owns it?

Ask where your data is physically stored. Ask whether it stays in the United States. Ask in writing that your clinic owns the data and can take it with you if you decide to leave. Get this in the contract.

Question 5: What does this cost in year one, year three, and year five?

eClinicalWorks cloud hosting is priced as a monthly fee per provider, with hosting bundled into that fee. But "per provider per month" is not a complete picture.

Get a written quote that itemizes the subscription cost, any add-on modules, the RCM percentage if you want managed billing, one-time implementation fees, data migration fees, the contract term, and the renewal pricing. Then run the math for five years at the renewal rate, not the promotional rate. Many clinics sign at a low first-year price and face a shock at renewal.

Question 6: What are the contract lock-in and exit terms?

Ask about the contract length. Ask whether it auto-renews. Ask about early termination fees. Ask what happens to your data and how long the migration takes if you decide to leave. Get all of this in writing before you sign.

Question 7: Who answers the phone at 2 a.m., and how fast?

Ask for the support escalation path in writing. Ask what the after-hours response time is. Ask whether the support team knows eClinicalWorks specifically or is a generalist help desk. If your EHR is down at 2 a.m., you need to know that the person answering the phone can actually help.

Question 8: How will the migration actually happen, and who owns it?

Ask the vendor to walk through their migration methodology step by step. How will they move your data? What is the cutover plan? What is the rollback plan if something goes wrong on day one? Who is responsible if the migration fails? Get this in writing.

Question 9: Is this vendor the right size for our clinic?

Ask how many other clinics they host. Ask whether they have a tenant cap. A vendor hosting thousands of practices is a different risk profile than one hosting a small pool. Understand what you are getting into.

What a local partner changes

If you are a clinic in western Wisconsin, the Chippewa Valley, or Southwest Florida without a dedicated IT department, you are probably the person fielding these calls and signing these contracts. You are also the person on the hook when something breaks.

A flat-rate managed IT partner who can be on-site quickly, who knows the regional compliance landscape (including Wisconsin syndromic surveillance requirements and the CMS Emergency Preparedness Rule), and who acts as the single point of accountability across IT, cybersecurity, phones, cloud, and AI is what turns "whoever picks up the phone" into a real answer. That partner sits between you and the hosting vendor, absorbs the finger-pointing, and makes sure someone is responsible when it matters.

Bring these nine questions to your next hosting vendor call, or send them to us and we will walk through your current contract with you.