[{"data":1,"prerenderedAt":94},["ShallowReactive",2],{"guide-medical-office-server-room-emr-en-US":3},{"guide":4,"related":77},{"title":5,"seoTitle":6,"description":7,"summary":8,"sections":9,"faq":43,"cta":50,"date":52,"updated":52,"service":53,"order":54,"sources":55,"slug":75,"locale":76},"An on-site server room for a practice's EMR","Medical Office Server Room for an EMR","What a NYC or Long Island practice needs to host its EMR on site: dedicated power and UPS, independent cooling, a logged door, fire protection and backups.","A practice that hosts its EMR on its own server keeps direct control of its data and can keep working on the local network when the internet fails, but it takes on the room, power, cooling and backups that a cloud vendor would otherwise carry. The room needs dedicated circuits on a UPS, a generator or transfer provision if the practice must run through long outages, cooling sized to the equipment and independent of the building's comfort system, a locked door with an access log, and fire protection that the code and the insurer accept. Off-site backup is still required. We build dedicated server rooms for practices that host their EMR and data on their own premises.",[10,15,23,28,33],{"heading":11,"paragraphs":12},"On site or in the cloud",[13,14],"Practices choose on-site hosting for control: the data stays on hardware the practice owns, in a room it locks. Large files such as imaging studies open faster from a local server, and staff can keep charting on the office network while the internet is down. The trade-off is ownership of the whole stack. The practice pays for the hardware and its replacement cycle, and its IT provider handles patching, monitoring and recovery.","A cloud EMR moves those duties to the vendor, which holds the data under a business associate agreement, and the office then depends on its internet connection for every visit. Some EMR products are offered only in the cloud. The choice belongs to the practice, its IT provider and its EMR vendor. We build the room to the equipment list they settle on, and we ask for it before the layout is drawn, because the rack count sets the size of the room, the circuits and the cooling.",{"heading":16,"paragraphs":17,"list":20},"Power and backup generation",[18,19],"Each rack receives its own dedicated circuits from the panel, sized by our licensed electrical partners from the nameplate ratings on the equipment list, with receptacles that match the UPS and power strips the IT provider specifies. Two circuits fed to the two power supplies of each server let one fail without stopping the server.","The UPS carries the room long enough either to shut the servers down cleanly or to bridge to a generator. Where the practice must stay open through a long outage, the room's circuits belong on a critical-load panel that a generator or battery system can feed, with a transfer switch or a generator inlet. Our guide to [backup power and network failover for clinics](\u002Fguides\u002Fclinic-backup-power-vaccine-network) covers how that panel is planned with the vaccine refrigerators and phones.",[21,22],"The firewall, core switch and internet modems go on the UPS with the servers; a server that stays up while the network goes down serves no one.","The UPS batteries add heat and weight, and they are replaced on a schedule, so they need space and access within the room.",{"heading":24,"paragraphs":25},"Cooling, temperature and humidity",[26,27],"Nearly all of the electrical power a server draws leaves it as heat, about 3.4 BTU per hour for each watt. The mechanical engineer sizes the cooling from the equipment list, the UPS losses and the room itself, and the system runs around the clock. A building's comfort system often sets back at night and on weekends, so the room receives its own cooling, usually a ductless split system on its own circuit, with a second unit where the practice cannot accept downtime.","The [ASHRAE TC 9.9 thermal guidelines](https:\u002F\u002Fwww.ashrae.org\u002Ffile%20library\u002Ftechnical%20resources\u002Fbookstore\u002Fsupplemental%20files\u002Ftherm-gdlns-5th-r-e-refcard.pdf) recommend air entering the equipment at 18 to 27 °C (about 64 to 81 °F), with a dew point between about 16 and 59 °F and relative humidity no higher than 70 percent, or 50 percent where corrosive gases are present. The server vendor's published limits govern its own equipment. Condensate lines from the cooling unit are routed away from the racks, and the room should not sit under plumbing from the floor above.",{"heading":29,"paragraphs":30},"Access control and fire protection",[31,32],"The HIPAA Security Rule's [facility access controls](https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F45\u002F164.310) call for limiting physical access to electronic information systems and the facilities that house them, controlling and validating access by role, and documenting repairs and modifications to security-related components such as doors, locks and walls. A server room supports those safeguards with a solid door, an electrified lock and card reader that logs every entry, a camera on the door from the corridor side, and no shared use as storage. The practice keeps the logs and the maintenance records; the room makes them possible. Our guide to [clinic design around the physical safeguards](\u002Fguides\u002Fhipaa-physical-safeguards-clinic-design) covers the rest of the suite.","In a sprinklered building the sprinkler system normally extends into the server room. Model building codes allow sprinklers to be omitted only in narrow cases, with the code official's approval and approved smoke detection in their place. Where the code, the fire department and the insurer allow it, a pre-action sprinkler system, which keeps water out of the piping until a separate detection system operates, or a clean agent system can protect the equipment with less risk of water damage. [NFPA 75](https:\u002F\u002Fwww.nfpa.org\u002Fcodes-and-standards\u002Fnfpa-75-standard-development\u002F75), the standard for fire protection of information technology equipment, is the usual reference. The fire protection engineer of record sets the design, and in New York City it is filed with the Department of Buildings and the FDNY as required.",{"heading":34,"list":35,"after":41},"Cabling, internet circuits, backup and monitoring",[36,37,38,39,40],"Ladder rack or cable tray above the racks, with a separate path for power and for data.","Conduit from the building's service entrance to the room, and room for [a second internet provider on a different medium or path](\u002Fguides\u002Finternet-service-entrance-planning), so one cut cable does not take the practice offline.","A bonded and grounded rack, labeled patch panels and spare capacity in the pathways for the next equipment change.","An off-site copy of the data. The Security Rule's [contingency plan standard](https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F45\u002F164.308) makes a data backup plan a required specification, and a backup kept only in the server room is lost with the room in a fire or flood.","Sensors for temperature, humidity, water on the floor, UPS status and door position, reporting to the IT provider on a network segment separate from the clinical systems.",[42],"We plan and build these rooms with licensed partner contractors for the electrical, HVAC and low-voltage work, and with engineering partners, whose design services are part of the project fee. The IT provider configures the servers, backups and alerts; the room is ready for them when the walls close.",[44,47],{"q":45,"a":46},"Does an on-site server room satisfy the HIPAA Security Rule?","No room satisfies the Security Rule by itself. HHS does not certify buildings or products, and compliance rests on the practice's risk analysis, policies, training and agreements. A locked, logged, cooled and backed-up server room supports the physical safeguards the practice documents in that program.",{"q":48,"a":49},"How large should a medical office server room be?","The equipment list decides. One or two racks need clear space in front and behind for service, room for the UPS and the cooling unit, and the working clearance the electrical code requires in front of any panel. We size the room from the IT provider's list and the rack vendor's clearances rather than from a standard square footage.",{"text":51},"Send the EMR vendor's server requirements, your IT provider's equipment list and the floor plan of the suite. Where practical we walk the space, and you receive at no charge the circuits, cooling, door hardware and cable pathways that equipment needs marked on your plan, followed by a written estimate for [the server room build-out](\u002Fservices\u002Fhealthcare) once the scope is known.","2026-10-25","healthcare",129,[56,60,63,67,71],{"title":57,"url":58,"publisher":59},"45 CFR § 164.310 - Physical safeguards","https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F45\u002F164.310","Cornell Law School, Legal Information Institute",{"title":61,"url":62,"publisher":59},"45 CFR § 164.308 - Administrative safeguards","https:\u002F\u002Fwww.law.cornell.edu\u002Fcfr\u002Ftext\u002F45\u002F164.308",{"title":64,"url":65,"publisher":66},"HIPAA Security Series: Security Standards: Physical Safeguards","https:\u002F\u002Fwww.hhs.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Focr\u002Fprivacy\u002Fhipaa\u002Fadministrative\u002Fsecurityrule\u002Fphyssafeguards.pdf","U.S. Department of Health and Human Services",{"title":68,"url":69,"publisher":70},"2021 Equipment Thermal Guidelines for Data Processing Environments, ASHRAE TC 9.9 Reference Card","https:\u002F\u002Fwww.ashrae.org\u002Ffile%20library\u002Ftechnical%20resources\u002Fbookstore\u002Fsupplemental%20files\u002Ftherm-gdlns-5th-r-e-refcard.pdf","ASHRAE",{"title":72,"url":73,"publisher":74},"NFPA 75, Standard for the Fire Protection of Information Technology Equipment","https:\u002F\u002Fwww.nfpa.org\u002Fcodes-and-standards\u002Fnfpa-75-standard-development\u002F75","National Fire Protection Association","medical-office-server-room-emr","en-US",[78,82,86,90],{"slug":79,"title":80,"description":81,"service":53,"date":52,"updated":52},"clinic-lease-checklist-nyc-long-island","Before you sign a clinic lease in NYC or Long Island","What to settle before leasing clinic space in NYC or Long Island: occupancy, Article 28, the certificate of occupancy and what the building can supply.",{"slug":83,"title":84,"description":85,"service":53,"date":52,"updated":52},"hipaa-physical-safeguards-clinic-design","Designing a clinic around HIPAA physical safeguards","How door hardware, cameras, workstation placement, a secure network closet and separated networks in a NYC clinic support the HIPAA Security Rule.",{"slug":87,"title":88,"description":89,"service":53,"date":52,"updated":52},"clinic-backup-power-vaccine-network","Keeping a clinic open through a power or network outage","Vaccine refrigerator outlets, UPS and generator options, a critical-load panel, internet failover and HVAC redundancy for NYC and Long Island clinics.",{"slug":91,"title":92,"description":93,"service":53,"date":52,"updated":52},"clinic-ventilation-filtration-nyc","Clinic ventilation and filtration in NYC and Long Island","What NYC and Long Island codes require for clinic ventilation, where ASHRAE 170 applies, MERV 13 vs HEPA, waiting-room pressure and filter access.",1792938766995]