9.4 Utility Interruptions, Downtime Procedures, Change Management, & Interoperability

Utility Interruptions, Downtime Procedures, Change Management, & Interoperability

The September 2026 ACI outline asks the CHTM to collaborate with stakeholders on utility maintenance and interruption — "network, telecom, electrical, plumbing, mechanical systems, change management, downtime procedures" — and to maintain device and systems interoperability (Operations items L2 and L3). Modern devices depend on building utilities and on the hospital network, so a change made by facilities or IT can silence an alarm or stop an interface. This section covers how HTM prevents that. Section 9.3 covers unplanned emergencies such as generator failures and floods.

---

1. Planned Utility Interruptions

Most interruptions are planned: shutdowns for construction, valve replacements, switchgear maintenance, or network upgrades. HTM's job is to translate "Zone valve 4 closes Tuesday 0200–0400" into a clinical risk plan.

Planning checklist for any planned interruption:

1. Receive notice through a formal process (a facilities or IT work-permit system that requires HTM review).
2. Query the CMMS by location and network segment to list the affected devices.
3. Rate the clinical risk and choose workarounds: portable or battery-powered equipment, loaners, moving patients or procedures, or rescheduling.
4. Notify affected units with an SBAR-style message giving time, impact, workaround, and contact.
5. Staff the event; HTM stands by for life-support areas.
6. Verify recovery: devices reconnect, interfaces flow, alarms reach phones, clocks resynchronize, and drug libraries are current.
7. Document the outcome and lessons learned.

---

2. Clinical Downtime Procedures for Connected Devices

Every connected system needs a written downtime procedure that describes what still works, what stops, and what clinicians do instead:

• Smart infusion pumps: Keep infusing with the last installed drug library. They cannot receive EHR auto-programming or library updates, so nurses program manually with independent double-checks. After recovery, confirm the library version on every pump.
• Central monitoring and telemetry: If the network between bedside and central station fails, bedside monitors still alarm locally, but remote viewing and alarm forwarding stop. Units assign staff to watch patients or monitors directly.
• Alarm notification systems (middleware to phones or pagers): When secondary notification fails, bedside alarms still sound. Units increase rounding and assign alarm observers until service is restored and tested end to end.
• Imaging and PACS: Modalities can store studies locally, and reading may move to local workstations. Afterward, studies are sent and reconciled so none are lost or misfiled.
• EHR device integration: Vital signs and pump data stop flowing into the chart, so nurses document manually and validate or reconcile data after recovery.

Downtime procedures should be practiced (tabletop or live drills), kept at the point of use, and updated after every real event.

---

3. Change Management: Protecting Devices from IT and Facilities Changes

Many device outages come from well-meant changes: a firewall rule update blocks pump-to-server traffic, a Wi-Fi controller upgrade drops telemetry roaming, an expired certificate stops an interface, or an operating system patch breaks an imaging workstation.

Elements of effective change control:

• Request for change (RFC) describing scope, timing, and systems touched.
• Impact assessment that includes medical devices, using the CMMS network inventory and interface map.
• A change advisory board (CAB) seat for HTM, so clinical engineering reviews changes that touch device networks.
• Scheduling in low-census windows with clinical notification.
• A back-out plan and an agreed decision time to reverse the change.
• Post-implementation verification: end-to-end testing of alarms, data flow, and device function.
• Emergency changes (for example, urgent security patches) follow an expedited path but are still documented and reviewed afterward.

IEC 80001-1:2021 (Application of risk management for IT-networks incorporating medical devices) gives this work a framework. It places responsibility on the healthcare delivery organization and its top management to manage risks to safety, effectiveness, and security when devices share IT networks. ACI's CHTM reference list includes several articles on applying 80001.

---

4. Maintaining Device and Systems Interoperability

Interoperability is the ability of devices and systems to exchange data and use it correctly — the right value, from the right patient, at the right time.

Key interoperability risks and controls:

• Wrong-patient association: Require positive patient identification (barcode or ADT link) when a device is associated or reassigned; audit unmatched data.
• Time mismatch: Synchronize device clocks to the hospital's network time source so device logs line up with the EHR (section 8.1).
• Version drift: Track firmware, interface engine, and EHR versions. Upgrading one can break another, so any change triggers end-to-end retesting.
• Latency and dropped messages: Monitor interface queues and alarm delivery times, and route alarms for failed interfaces to IT and HTM.
• Unclear ownership: Write a RACI chart (responsible, accountable, consulted, informed) that names who owns each device, server, interface, and network segment.