What to check in an EHR contract before you sign

Most of an EHR contract is boilerplate you will never think about again. A handful of clauses are not, and the one that matters most is the one almost nobody negotiates: what happens to your data when you want to leave.

That clause sets the price of every decision you make afterwards. A practice that can extract a clean, structured copy of its records on demand can change its mind. A practice that cannot is going to stay where it is, and the vendor's renewal quote will reflect that. Everything else in this post is downstream of it.

The only part you can't replace

Software is replaceable. Your records are not.

If a vendor disappears tomorrow you can buy other software by the end of the week. You cannot reconstruct ten years of clinical history, and you are the one holding the retention obligation — your state's medical-record retention rules apply to the practice, not to the company hosting the database. That asymmetry is the entire reason the export clause deserves more attention than the price.

It is also the reason to read it before signing rather than at the point of leaving. At signing you have leverage, because the vendor wants the deal. At termination you have none, because they already have your data.

"Can I export my data" is the wrong question

Every vendor says yes. The answer is close to meaningless, because it does not specify what comes out.

The real question is what the export contains and what shape it is in. There is an enormous practical distance between:

• a structured, machine-readable export that another system can actually ingest — problems, medications, allergies, results, encounter notes, with the relationships between them intact;
• a per-chart PDF dump, which is technically your complete record and is also a filing cabinet you now have to pay someone to retype;
• a CSV of demographics and appointments, with the clinical narrative either flattened into an unusable text blob or missing entirely;
• and an export that includes everything except the one thing you cared about — commonly scanned documents, inbound faxes, images, or the message history with your patients.

Ask which of those you are being offered. Then ask for something better than an answer: a sample export file, generated from a real account, before you sign. A vendor confident in their export will produce one. A vendor who will not is telling you something useful.

One piece of leverage worth knowing about. If the system you are evaluating is certified under the ONC Health IT Certification Program, the certification criteria include an electronic health information export criterion at 45 CFR 170.315(b)(10). It requires a certified module to let a user create an export of all of a single patient's electronic health information that the product can store, and a second export covering all patients — in both cases "electronic and in a computable format," accompanied by "the publicly accessible hyperlink of the export's format." Computable, and with the format documented publicly, is a meaningfully higher bar than a pile of PDFs.

Two honest caveats. Not every EHR is certified, and certification is not a promise of a painless migration — it describes a capability the product demonstrated, not how well it works on your data at 2am on a deadline. But if the product is certified, the criterion exists, the format is supposed to be published, and you can ask to see both. That is more leverage than most small practices realize they have.

Who owns the record

Most contracts already say the practice owns its clinical data and the vendor owns the software. That sentence is worth having and is not worth much on its own.

What to check underneath it:

• Ownership versus custody versus license. You may own the data while the vendor holds the only practical means of getting it. Ownership without a usable export is a statement about principle, not about control.
• What the vendor may do with it. Look for rights to use practice or patient data for the vendor's own purposes — analytics, benchmarking, product development, model training. If those rights exist, they should be explicit, bounded, and something you agreed to knowingly rather than discovered in a definitions section.
• Whether the BAA agrees with the main agreement. Where Zenthea's kind of arrangement applies — a vendor handling PHI on a practice's behalf — the business associate agreement governs a lot of this, and it should not contradict the master terms. When they conflict, ask which one controls, in writing.
• Your obligation, not theirs. Retention requirements sit with you. If the contract lets the vendor delete your data thirty days after termination, that clause and your state's seven-year retention rule are on a collision course, and you are the one who loses.

What it costs to leave

Assume there is a cost, and find out what it is now.

• Is there an extraction or export fee at all? Sometimes there isn't. Sometimes it's four figures.
• Is the number stated in the contract, or is it "the vendor's then-current rates"? The second is not a price. It is an option the vendor holds against you, exercisable at the worst possible moment. Push to have a figure or a cap written in.
• Is it charged per chart? Per-chart pricing looks trivial at ten patients and is a serious number at four thousand.
• Are professional-services hours required? If the export needs vendor engineering time to produce, that time is billable and the rate is usually not in the contract either.
• How long do you have? A termination clause commonly gives a window — thirty, sixty, ninety days — to request your data before it is deleted. Know the number, and know whether the clock starts at notice or at the end of the term.

Notice periods and auto-renewal

This is the clause that quietly does the most damage to small practices, and it costs nothing to get right.

An auto-renewal with a ninety-day notice window means the decision to leave has to be made three months before a renewal you are probably not thinking about. Miss it by a week and you owe another full term. It is not a trick — it is in the contract you signed — but it catches practices constantly, because the deadline arrives nine or twenty-one months into a period during which nobody is thinking about the contract.

Three things to do about it:

1. Read the notice window and the renewal term, and check whether the renewal is for the same length as the original.
2. Put the notice deadline in a calendar the day you sign, with a reminder a month before it. This is the highest-value five minutes in the entire purchase.
3. Look for a price-escalation cap. If renewal pricing is unconstrained, an auto-renewal is also an open-ended price increase. A stated cap — or at least a requirement of advance written notice of any increase — is a reasonable ask.

Three more clauses worth the read

• Uptime and support commitments. Not the marketing number — what the contract actually promises, what counts as an outage, and what the remedy is. If the remedy is a service credit worth a few percent of a monthly fee, understand that you are not really buying availability, you are buying an apology.
• Assignment and change of control. What happens to your terms if the vendor is acquired. Small health IT companies get bought, and your pricing and roadmap can change with them.
• What happens if they shut down. Rare, and catastrophic when it isn't. Ask whether there is any provision for data return on insolvency.

What to ask for before you sign

Short list, in priority order:

1. A sample export file from a real account.
2. The export cost written as a number or a cap, not a reference to future rates.
3. The post-termination data-retention window, in days.
4. The notice deadline, in your calendar, before you countersign.
5. A price-escalation cap, or advance written notice of increases.

None of these are unusual requests. A vendor who treats them as unusual has told you how the relationship is going to go.

Where Zenthea fits

Zenthea is built as an AI-native EHR, and the argument above cuts against us as much as anyone: a practice that can leave easily is a practice that has to be kept, which is the right incentive for a vendor to be under.

Our position is simply that these questions should be asked of every system on your shortlist, ours included, and asked while you still have the leverage of not having signed. If a vendor will not show you an export, that is an answer.

The related question is what leaving actually costs once you decide to do it — the contract sets the price, but the bill has a lot of other lines on it. That is covered in what switching EHRs actually costs a small practice, and the broader case for why a direct practice should weigh these systems differently in the first place is in what an EHR for a cash-pay or direct primary care practice has to do differently.