Minute by minute, the first quarter hour looks like this:
Minutes 0 to 3: confirm the scope. One workstation or all of them? One location or every location? Can you reach other websites? Scope tells you instantly whether the problem is local (network, server) or upstream (vendor, internet carrier).
Minutes 3 to 5: declare downtime. The most expensive mistake is the optimistic wait, with the lobby filling while everyone hopes it comes back. Whoever holds the authority (decide this before it happens) announces downtime mode, and the front desk pulls the printed downtime kit: today's schedule, paper encounter forms, medication reference for active patients.
Minutes 5 to 10: make the calls in parallel. Your IT partner first, because triage is their job; the EMR vendor if scope points upstream. Give both the same facts: when it started, what the screens show, what changed recently.
Minutes 10 to 15: stabilize the clinic. Rooms keep flowing on paper, someone owns the phones, and nobody reboots servers or "tries things" on their own; amateur fixes during an outage destroy the evidence and sometimes the database.
Everything past minute 15, including recovery targets, data re-entry, and when a vendor outage becomes your breach problem, lives in our full EHR downtime plan template, which includes the printable kit.