A Critical Access Hospital buys an EHR under constraints almost no vendor's default demo accounts for: no more than 25 inpatient beds, an annual average length of stay of 96 hours or less, 24-hour emergency services seven days a week, and the nearest other hospital more than 35 miles away. Those are not descriptive characteristics, they are the CMS certification criteria — and each one changes what the EHR has to do. The bed count means you are buying inpatient capability at a scale that inpatient products are not priced for. The 96-hour average means throughput and swing-bed mechanics matter more than length-of-stay analytics. The 35 miles means downtime is not an inconvenience, because there is nowhere to divert to. A CAH is not a small hospital. It is a differently shaped one.
What a Critical Access Hospital actually is
CAH is a Medicare certification, not a size category. To be certified, CMS requires a facility to:
- Maintain no more than 25 inpatient beds, usable for either inpatient or swing-bed services.
- Maintain an annual average length of stay of 96 hours or less per patient for acute inpatient care, excluding swing-bed services and beds in distinct part units.
- Furnish 24-hour emergency care services, seven days a week.
- Be located more than 35 miles from the nearest hospital or CAH — or more than 15 miles in areas with mountainous terrain or only secondary roads.
- Comply with the CAH Conditions of Participation at 42 CFR Part 485 Subpart F.
Read that list as a requirements document and the EHR implications fall out of it directly.
Why the designation changes the EHR question
Most EHR products sit at one of two poles. Ambulatory systems are built for clinic visits and have no real inpatient census, no swing beds, and no emergency department. Enterprise inpatient systems have all of it, priced and staffed for a facility with an IT department, an interface team, and an analytics group.
A CAH needs the inpatient feature set at the ambulatory operating scale. That combination — genuine inpatient, ED, and swing-bed capability, run by a team that may be one person, on a budget that is not an enterprise budget — is the actual problem, and it is why CAH EHR selection is not simply "pick a small version of a big system."
| CAH criterion | What the EHR has to do |
|---|---|
| ≤ 25 beds, inpatient or swing | Census, orders, MAR, and bed status that flip between acute and swing without a separate module |
| 96-hour average stay | Fast admit and discharge; the reporting to actually track the average you are certified against |
| 24/7 emergency care | ED tracking, triage, and after-hours coverage with a skeleton night staff |
| > 35 miles from the next hospital | Downtime procedures that work with no diversion option; transfer and referral data flow |
| 42 CFR 485 Subpart F | Documentation that supports the CoPs your surveyors read |
Swing beds and the 96-hour average
Swing beds are where CAH-specific EHR gaps usually surface first, because the same physical bed changes regulatory identity depending on the patient in it. The system has to handle a patient moving from acute to swing status without a re-admission fiction, carry the documentation each status requires, and keep the two out of the same length-of-stay calculation — because the 96-hour average is computed on acute inpatient care and expressly excludes swing-bed services and distinct part unit beds.
That exclusion is not a reporting nicety. It is the arithmetic behind a certification you have to maintain. Ask a vendor to show you the report that produces your annual average length of stay, with the exclusions applied, using their data. If the answer is that it can be built, that is a different answer from it existing.
A 24/7 emergency department with a small team
Every CAH runs an emergency department around the clock, and it is frequently staffed overnight by very few people who are also covering the inpatient side. What that does to EHR requirements is specific:
- The tracking board has to be usable by someone doing three jobs. Click depth is a staffing cost here in a way it is not at a facility with dedicated ED clerks.
- Break-glass emergency access has to work and be logged. The Security Rule makes emergency access procedure a Required implementation specification at 164.312(a)(2)(ii). At 3am with one nurse, an access control that cannot be overridden safely gets worked around permanently.
- Order sets need to match the transfer reality. A meaningful share of ED presentations end in transfer, so the documentation that travels matters as much as the documentation that stays.
Downtime, where the nearest alternative is 35 miles away
This is the requirement most worth over-weighting, and the CAH definition is why.
Every covered entity already owes a contingency plan under the Security Rule at 45 CFR 164.308(a)(7). Three of its implementation specifications are Required, not addressable: data backup plan, disaster recovery plan, and emergency mode operation plan — the last being procedures to continue critical business processes protecting ePHI while operating in emergency mode. Testing and revision procedures and applications and data criticality analysis are addressable.
So evaluate it as a first-class requirement rather than a contract appendix. Ask what read-only access exists during an outage, whether it runs locally or depends on the same connection that is down, how orders are captured on paper and reconciled afterward, and how long recovery actually took at a comparable site. And ask about the internet link itself — for a cloud EHR at a rural facility, the circuit is a single point of failure that a suburban buyer never has to think about.
Interoperability with the referral center
A CAH stabilizes and transfers. That means its most valuable integration is usually not internal — it is the data path to the referral hospital, which is very often running a large enterprise system the CAH will never buy.
Concrete questions worth asking: how does a transfer summary reach the receiving facility today, and does it arrive as a document a human opens or as data that lands in the chart? What happens to results that come back afterward? If your referral center participates in a health information exchange or a national network, does your EHR?
Certification is worth verifying rather than assuming. CAHs in the Medicare Promoting Interoperability Program are required to use certified EHR technology, and certification is granted to specific product versions against specific criteria under the ONC Health IT Certification Program. The Certified Health IT Product List is public and searchable, and checking a product there takes a minute. Do that rather than accepting a line in a proposal.
The IT team of one
The most under-modeled CAH constraint is staffing. A single IT generalist — frequently also responsible for the phones, the badge system, and the printers — is common, and it reshapes the buying criteria:
- Who applies updates, and when? An enterprise product assuming a change-control board assumes a board you do not have.
- Who owns the interfaces? Every interface is a thing that breaks at 2am.
- Who does the security work? The security official designation at 164.308(a)(2) is required, and information system activity review at 164.308(a)(1)(ii)(D) — regularly reviewing audit logs and access reports — is Required. Both land on the same person.
- Who walks the closets? Physical safeguards at 164.310 cover facility access, workstation surroundings, and media disposal, and a CAH with attached clinics has several buildings' worth of them.
- What happens when that person is on vacation? Ask the vendor what their support does when the customer's entire IT department is unreachable for a week. It is a fair question and the answer is revealing.
A CAH buying checklist
- Show me swing-bed status change in the live product, not in slides.
- Produce my 96-hour average length-of-stay report, with the exclusions applied.
- Demonstrate the ED tracking board at overnight staffing levels.
- Walk me through a full downtime and recovery, including read-only access and paper reconciliation.
- Verify the product and version on the CHPL in front of me.
- Show a transfer summary arriving at a referral center on the system ours uses.
- Name every site in scope, including attached rural health clinics, and price site two through the last one.
- Tell me what your support does when our one IT person is unavailable.
- Give me two CAH references at my bed count — not two hospitals.
- Put the total cost including interfaces, training, and hardware in one number.
The takeaway
The CAH certification criteria are a requirements document that CMS already wrote for you. Twenty-five beds, a 96-hour average, an emergency department that never closes, and 35 miles of distance between you and the nearest alternative — each of those is a constraint no ambulatory product was built for and no enterprise product was priced for.
Evaluate against the criteria rather than against the demo. And weight downtime heavily, because the distance that earned you the designation is the same distance that will define the night your systems go down.
Common questions
What qualifies a hospital as a Critical Access Hospital?
CMS certification requires a hospital to maintain no more than 25 inpatient beds usable for inpatient or swing-bed services, maintain an annual average length of stay of 96 hours or less per patient for acute inpatient care, furnish 24-hour emergency care services seven days a week, and be located more than 35 miles from the nearest hospital or CAH, or more than 15 miles in areas with mountainous terrain or only secondary roads. CAHs must also comply with the Conditions of Participation at 42 CFR Part 485 Subpart F.
Do Critical Access Hospitals need certified EHR technology?
CAHs participating in the Medicare Promoting Interoperability Program are required to use certified electronic health record technology. Certification is administered under the ONC Health IT Certification Program, and you can verify any product's certification status and the specific criteria it holds on the Certified Health IT Product List, which is public and free to search. Verify the certification yourself rather than accepting the claim from a proposal, because certification is granted to specific product versions against specific criteria.
Why does EHR downtime planning matter more for a Critical Access Hospital?
Because the alternative is farther away. A CAH is by definition more than 35 miles from the nearest hospital, so patients cannot simply be diverted while systems are restored. The HIPAA Security Rule's contingency plan standard at 45 CFR 164.308(a)(7) already makes data backup plan, disaster recovery plan, and emergency mode operation plan all Required implementation specifications for every covered entity. For a CAH those requirements coincide with an operational reality where the downtime procedure is not a formality but the actual plan for delivering care that night.
Does a Critical Access Hospital with attached clinics need one risk analysis or several?
The HIPAA Security Rule requires an assessment of risks to all ePHI the organization holds, regardless of location. HHS guidance states that electronic media includes a single workstation as well as complex networks connected between multiple locations, and that the analysis should account for all ePHI regardless of the source or location of it. So a CAH operating attached rural health clinics needs a scope that reaches every one of them. Whether that is delivered as one engagement or several is a commercial decision, but no site holding ePHI falls out of scope because it is small.