SLA Composition and Cutover for a Clinical Records Platform
Meridian Health is moving its electronic health record modules to a vendor-hosted SaaS platform. Medication ordering has a 6-hour recovery time objective and a 15-minute recovery point objective; imaging metadata has a 4-hour RTO and 1-hour RPO. The vendor offers 99.9% monthly availability for the SaaS, relies on one hyperscale region, and excludes planned maintenance up to four hours per month. Clinicians require 99.95% availability during 07:00-19:00 for ordering. The migration covers 500 clinics over nine months, with an interface engine and identity federation remaining on-premises. A pilot at two hospitals shows 180 ms round-trip latency, above the 120 ms target. The board asks whether the vendor SLA is sufficient. The contract is due for signature in 30 days. No exit plan has been drafted.
1. Assess whether the vendor's 99.9% SLA supports the 99.95% clinical requirement. Show the reasoning, including dependency and maintenance effects.
Read the worked answer
The SLA does not support the requirement as written. A 99.9% monthly availability target permits about 43.2 minutes of unplanned downtime in a 30-day month; 99.95% permits about 21.6 minutes. If the contract also excludes up to four hours of planned maintenance per month, the effective availability experienced by clinicians is worse unless maintenance is outside the 07:00-19:00 clinical window and is explicitly excluded from the measurement. The measurement window, whether it is 24x7 or clinical hours, also changes the arithmetic, so the SLA must state it.
The architecture compounds the gap. The interface engine and identity federation remain on-premises; a cloud outage may not be the only failure, but an on-premises identity failure can still stop ordering. In a serial dependency, composite availability is the product of the dependent components, so the SaaS figure is not the clinical service figure. A single hyperscale region adds correlated risk, and 180 ms latency above the 120 ms target affects clinician usability even when the service is technically available.
Meridian should not accept the SLA as sufficient. It should negotiate clinical-hours availability, maintenance windows outside 07:00-19:00, service credits tied to the clinical service, multi-zone or warm-standby design for ordering, local queuing or read-only mode, and an exit plan. Internally, it should define an end-to-end SLO for medication ordering and measure it from the clinic edge, not only from the vendor API.
2. Define transition acceptance criteria and rollback triggers for the first two hospitals.
Read the worked answer
Acceptance criteria should be evidence-based and tied to clinical workflows, not just technical checks. Before go-live, require successful completion of scripted ordering scenarios for adult, paediatric, and high-alert medications; identity federation and role mapping tests; interface throughput at peak load; p95 round-trip latency at or below 120 ms from each hospital; data reconciliation against the source for a defined sample; security and audit-log validation; and a recovery test that meets the 6-hour RTO and 15-minute RPO. The vendor maintenance calendar and escalation contacts must be confirmed.
Rollback triggers should be pre-agreed and observable. Examples: more than 2% of medication orders failing for 15 minutes; p95 latency above 120 ms for 30 minutes during clinical hours; identity federation unavailable for 10 minutes; unreconciled order data above the agreed threshold; or a severity-1 incident with no credible workaround. The rollback decision should belong to a named clinical and IT authority, not to a committee convened after the event.
Transition should include a dual-run or read-only fallback period, a freeze on non-essential changes during cutover, and a runbook tested at the two pilot hospitals. Exit criteria for the pilot should include 30 days of stable operation, incident trends, clinician feedback, and closure of severity-1 and severity-2 defects. Because no exit plan exists, the contract signature should be conditional on a documented exit and data-extraction plan, including minimum notice, data return format, and transition assistance.