Chapter 9 Part II — The System Design Lifecycle

Optimization, Support, Maintenance, Downtime, and Evaluation

How informatics sustains systems after go-live, learns from real use, governs change, and prepares for failure.

Chapter Orientation

Go-live is the beginning of operational truth. Once real users, real patients, real workloads, and real exceptions enter the system, the organization can finally see whether the design behaves as intended. Mature informatics teams treat post-go-live work as a structured learning system rather than an endless queue of tickets.

Maintenance and downtime also reveal an important principle: healthcare technology must be designed for failure. Networks, devices, vendors, interfaces, identity providers, and cloud services can become unavailable. Safe digital operations depend on knowing what must continue, what can wait, and how information will be reconciled afterward.

Learning Objectives

By the end of this chapter, you should be able to:

  1. Distinguish maintenance, support, stabilization, and optimization.
  2. Use tickets and user feedback as structured operational data.
  3. Explain release, environment, and version-control concepts at an informatics level.
  4. Evaluate adoption, satisfaction, usability, performance, and outcomes.
  5. Design downtime and recovery workflows around clinical continuity.
  6. Explain reconciliation after downtime.
  7. Build an optimization governance model that prevents uncontrolled customization.

Lesson 9.1 — Support Tickets Are Data About the System

  • A ticket is an observation, not automatically the problem definition. “Report broken” may mean incorrect filters, misunderstood definitions, permissions, missing data, or a genuine defect. Support staff should capture enough context to classify mechanism and impact.

  • Ticket patterns reveal systemic issues. One password-reset ticket is support. Hundreds after a role change indicate provisioning or identity-design problems. Repeated requests for the same workaround may reveal a design gap that individual ticket closure hides.

  • Severity and priority are different. A rare defect that can cause patient harm may be high severity even if few users report it. A widespread cosmetic problem may have high volume but lower clinical severity. Governance should prevent ticket counts from substituting for risk assessment.

  • Support knowledge should feed design. Resolved issues can become knowledge articles, training updates, automated checks, or optimization candidates. If the same ticket returns, the organization has not truly resolved the underlying problem.

AIAI in Practice

AI in Practice — Cluster Support Themes

An approved LLM can classify de-identified ticket text into themes, suggest duplicate clusters, and identify candidate root causes. Human review is required because ticket language is ambiguous and model clustering can merge clinically different problems that share vocabulary.

NI-BC Connection: System Design Lifecycle — supporting end users and leadership, help desk tickets, optimization.

?Retrieval Checkpoint

Retrieval Checkpoint

  1. Why is a ticket not necessarily a valid problem statement?
  2. How can ticket trends reveal a system-level failure?
  3. Distinguish severity from priority.
  4. What should happen to support knowledge after an issue is resolved?

Lesson 9.2 — Environments, Releases, and Controlled Change

  • Separate environments reduce the risk of changing production directly. Organizations commonly maintain development/build, test, training, and production environments, although names and architecture vary. The important principle is controlled promotion of validated change.

  • Environment drift creates false confidence. If test configuration differs from production, a passed test may not predict production behavior. Informatics teams should understand which content, interfaces, users, and data are synchronized and where differences are intentional.

  • Version control preserves change history. Informatics professionals do not need to be software engineers to understand why configuration, scripts, documents, and interface specifications should have identifiable versions, owners, and change records.

  • Release governance bundles change deliberately. Too many uncoordinated production changes increase regression risk and make it difficult to identify what caused a problem. Too little change creates long backlogs. Release cadence should reflect risk, testing capacity, operational readiness, and urgency.

PInformatics in Practice

Informatics in Practice — Production Is Not a Test Environment

Emergency changes sometimes occur, but they should have explicit authorization, limited scope, documented rationale, validation, and retrospective review. “It is easier to try it in production” is a governance failure.

NI-BC Connection: System Design Lifecycle — maintaining test/training/production environments, documentation, software version control.

?Retrieval Checkpoint

Retrieval Checkpoint

  1. What is the purpose of separate system environments?
  2. Why is environment drift dangerous?
  3. What does version control contribute to informatics governance?
  4. Why should release cadence balance speed with testing and readiness?

Lesson 9.3 — Optimization: Improve the System Without Recreating Chaos

  • Optimization should be hypothesis-driven. Define the observed problem, proposed mechanism, expected improvement, affected users, risk, and measure. Otherwise, optimization becomes a sequence of preference changes with no evidence of benefit.

  • Standardization creates leverage when common work is truly common. Shared forms, definitions, and workflows reduce maintenance and improve comparability. But standardization should not erase clinically meaningful differences. Governance needs criteria for justified exceptions.

  • Every optimization has a maintenance cost. A local field, alert, or report becomes another item to test during upgrades, train, document, and support. The cumulative cost of small customizations can exceed the original benefit.

  • Optimization should examine whether the problem is design, adoption, policy, or data. Changing configuration for a policy ambiguity may embed confusion. Training users around a design defect may preserve poor workflow. Correct classification matters.

  • Retirement is part of optimization. Old alerts, reports, forms, interfaces, and workarounds should be actively removed when no longer needed. Systems become harder to use when organizations only add and never subtract.

EClinical Example

Clinical Example — The 46 Reports

A department has 46 variants of a census report, most created to satisfy one-time preferences. Only eight were accessed in the past six months. Optimization is not building report 47; it is determining which information needs are legitimate, consolidating definitions, retiring unused variants, and establishing a governance process for new reports.

NI-BC Connection: System Design Lifecycle — optimization, change governance, system performance.

?Retrieval Checkpoint

Retrieval Checkpoint

  1. What makes optimization hypothesis-driven?
  2. Why can standardization and local variation both be appropriate?
  3. What hidden costs accompany customization?
  4. Why is retirement an optimization activity?

Lesson 9.4 — Evaluation: Adoption Is Not the Outcome

  • Adoption answers whether people use the system, not whether the system improves care. High login rates can coexist with workarounds, low data quality, and poor outcomes. Evaluation should match the original purpose of the intervention.

  • Use multiple measure layers. System performance may include uptime and latency. User performance may include task success and time. Adoption may include frequency and workflow penetration. Clinical/operational outcomes may include safety, quality, throughput, or burden.

  • Satisfaction should be interpreted, not worshiped. Users may dislike a necessary safety control or like a shortcut that weakens documentation. Satisfaction matters because it affects adoption and burden, but it is one signal among several.

  • Qualitative evidence explains quantitative findings. If adoption is low, interviews and observation can reveal whether users lack trust, cannot access devices, do not understand the feature, or have developed an alternative workflow.

  • Evaluation should ask whether effects persist. Early go-live attention can temporarily improve adherence. Monitor whether performance remains stable after command-center support and leadership attention decrease.

FFigure

Figure 9.1 — Evaluation Layers After Go-Live

Visual structure: Technology performance → user/workflow performance → adoption → data quality → clinical/operational outcomes → unintended effects. Arrows show that failure at an earlier layer can affect later outcomes.
Alt text: Layered post-implementation evaluation from system reliability through user behavior, data quality, outcomes, and unintended effects.

NI-BC Connection: System Design Lifecycle — user experience, adoption, satisfaction, monitoring performance.

?Retrieval Checkpoint

Retrieval Checkpoint

  1. Why is adoption not equivalent to effectiveness?
  2. What different evaluation layers should be considered?
  3. Why can satisfaction conflict with safety?
  4. What can qualitative evidence explain that usage statistics cannot?

Lesson 9.5 — Downtime and Recovery Are Clinical Workflows

  • Downtime planning begins with clinical continuity, not the server. Identify which care activities must continue, what information clinicians require, what can be documented temporarily, how orders and medication administration are handled, and how communication occurs without normal systems.

  • Planned and unplanned downtime share needs but differ in preparation. Planned upgrades allow scheduling, preprinting, staged communication, and resource preparation. Unplanned outages require rapid detection, notification, fallback workflows, and uncertainty management.

  • Dependencies determine the real blast radius. An EHR may be available while identity, network, interface engine, pharmacy system, label printer, or cloud service is down. Downtime plans should map dependencies rather than assume one application equals one failure mode.

  • Recovery includes reconciliation. Paper orders, medication administrations, results, notes, and patient movement during downtime may need to be entered, scanned, reconciled, or otherwise preserved. Recovery is not complete when the login screen returns.

  • Downtime drills reveal hidden assumptions. Tabletop exercises and simulations can expose missing forms, outdated contact lists, printers without supplies, staff unfamiliarity, and unclear authority. A plan that has never been exercised is a hypothesis.

AIAI in Practice

AI in Practice — Adversarial Downtime Tabletop

Use an LLM to inject escalating complications into a tabletop exercise: outage during shift change, interface recovery before EHR recovery, pharmacy connectivity loss, missing downtime forms, or delayed restoration. A facilitator should control the scenario and ensure no sensitive architecture details are placed in an unapproved model.

NI-BC Connection: System Design Lifecycle — downtime, scheduled maintenance, disaster/emergency recovery.

?Retrieval Checkpoint

Retrieval Checkpoint

  1. Why should downtime planning begin with clinical functions?
  2. What is a blast radius?
  3. Why is system restoration not the end of recovery?
  4. What can a downtime drill reveal that a written plan cannot?

Chapter Case Study — The Four-Hour EHR Outage

At 06:15, an identity-service failure prevents staff from logging into the EHR across a regional health system. The network remains available, but SSO authentication fails. Some users with existing sessions remain connected for 20 minutes before timing out. Laboratory instruments continue processing but results cannot reach the EHR. Pharmacy systems are available locally, but medication-administration scanning depends on EHR authentication.

Downtime forms exist, but one unit cannot find the current medication-administration form. At 08:10, identity service is restored. Interfaces begin sending queued messages. Several duplicate lab results appear because a retry process resubmits transactions. Staff are unsure which paper documentation must be back-entered.

Analyze the case

  1. Which dependencies widened the blast radius?
  2. What clinical functions should have been prioritized during the outage?
  3. What support and communication failures are visible?
  4. What reconciliation risks exist after restoration?
  5. Which data-quality checks are necessary before declaring recovery complete?
  6. What should change in the downtime plan after the event?

Chapter Synthesis

  • Support data should feed system learning. Repeated tickets are evidence of a pattern, not merely workload.
  • Controlled environments and release governance reduce avoidable risk.
  • Optimization should improve measurable value and retire unnecessary complexity.
  • Evaluation must connect system behavior to workflow, data quality, and outcomes.
  • Downtime is a clinical continuity problem. Recovery includes information reconciliation and validation.

Key Terminology

Environment
Segregated instance or context used for build, test, training, or production work.
Environment drift
Meaningful difference between environments that undermines testing reliability.
Version control
Method for tracking identifiable changes and history of artifacts or code/configuration.
Release
Controlled set of changes promoted into an operational environment.
Optimization
Structured improvement of an existing operational system or workflow.
Adoption
Extent to which intended users incorporate a system or feature into actual work.
Downtime
Period when a technology or dependent capability is unavailable or degraded.
Blast radius
Scope of systems, users, or workflows affected by a failure.
Reconciliation
Process of comparing and resolving data/actions generated during disruption with restored electronic records.

NI-BC Chapter Mapping

Domain Blueprint area Lessons Depth
II. Lifecycle Technical/system maintenance and environments 9.2 Applied
II. Lifecycle Documentation/version control 9.2 Reinforced
II. Lifecycle User experience/adoption/satisfaction 9.4 Applied
II. Lifecycle End-user/leadership support, tickets, optimization 9.1, 9.3 Applied
II. Lifecycle Downtime/disaster recovery 9.5 Applied
II. Lifecycle Monitoring system performance 9.4 Applied

Chapter Quiz

Answer each question, then select “Check answer” to reveal feedback. For Select All That Apply items, choose every correct option before checking. Expand “Why?” after checking to read the rationale.

1

A recurring ticket theme appears after every role change. What is the best informatics interpretation?

Why?

Repeated tickets linked to the same triggering condition suggest a systemic provisioning or identity design problem, not a series of unrelated user failures.

2

Which statement best distinguishes severity from priority?

Why?

Severity describes consequence if the problem occurs; priority determines when it should be addressed after considering severity, scope, urgency, dependencies, and other context.

3

Environment drift can involve differences in:Select all that apply

Why?

Environments can diverge in configuration, interfaces, roles, data, and software versions, making test results less representative of production.

4

Why is production change without controlled validation risky?

Why?

An uncontrolled production change exposes patients and users to unvalidated behavior and makes it harder to determine which change caused an outcome.

5

Which optimization request is strongest?

Why?

The strongest request connects observed burden to a measurable desired effect while preserving required clinical information.

6

High feature usage proves:

Why?

Usage demonstrates adoption or exposure, not that the feature improves safety, quality, efficiency, or outcomes.

7

Post-go-live evaluation may include:Select all that apply

Why?

Post-go-live evaluation spans technical performance, task completion, adoption, data quality, outcomes, and unintended effects.

8

During downtime, which should drive planning first?

Why?

Downtime planning starts with the clinical capabilities and information that must continue, then maps technology and contingency procedures to those needs.

9

Why can queued interface messages create risk during recovery?

Why?

Queued messages may replay out of order, duplicate, or arrive after local actions occurred, so recovery requires reconciliation rather than simply restarting interfaces.

10

A downtime drill can test:Select all that apply

Why?

A meaningful drill tests materials, contact information, staff behavior, communication, authority, and post-restoration reconciliation. —

Progress: 0 of 10 checked.

References and Further Reading

  • American Nurses Credentialing Center. (2025). Informatics Nursing Board Certification Examination: Test Content Outline. https://www.nursingworld.org/globalassets/informatics-tco_08292025-for-webposting.pdf
  • Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology. (2025). SAFER Guides. See especially the Contingency Planning and System Management guides. https://healthit.gov/clinical-quality-and-safety/safer-guides
  • Agency for Healthcare Research and Quality. Health IT Evaluation Toolkit and Evaluation Measures Quick Reference Guides. https://digital.ahrq.gov/health-it-evaluation-toolkit
  • National Institute of Standards and Technology. (2010). Contingency Planning Guide for Federal Information Systems (SP 800-34 Rev. 1). https://doi.org/10.6028/NIST.SP.800-34r1
  • Institute of Medicine. (2012). Health IT and Patient Safety: Building Safer Systems for Better Care. National Academies Press. https://nap.nationalacademies.org/catalog/13269/health-it-and-patient-safety-building-safer-systems-for-better