Every practice manager I know has at least one EMR horror story. The vendor demoed beautifully, the sales rep answered every question with confidence, and eighteen months later you're paying for modules you don't use, exporting data you can't actually use elsewhere, and wondering how the contract got renewed automatically while you were dealing with a staffing crisis.

The due diligence you do before signing is worth more than any implementation checklist afterward. Here's what I audit before a contract goes to counsel, based on what actually causes pain later.

Data ownership and export mechanics

Start with the exit before you talk about the entry. Ask the vendor to show you, on a screen share, exactly how you would export your data if you left tomorrow. Not a PDF of the contract clause. The actual export tool.

You want to know: what formats are supported (CCDA, HL7, FHIR, flat CSV), whether attachments and scanned documents come with the export or separately, whether audit logs are included, and how long the export takes for a database your size. I've watched vendors quote "full data portability" and then reveal that structured note data exports as one giant blob of HTML per encounter. Technically portable. Practically useless.

Get written confirmation on:

  • Who owns the data (you should, unambiguously)
  • The cost of an export (many vendors charge four or five figures)
  • The timeline they'll commit to in writing
  • Whether they'll assist with migration to a named competitor or only "provide the file"
  • What happens to your data 30, 60, and 180 days after termination

The real total cost, not the per-provider number

The per-provider-per-month figure on the proposal is almost never what you'll pay. Build a spreadsheet with every line item the contract references and every line item that shows up in the demo but isn't in the base price. In compounding and concierge practices specifically, watch for:

  • Patient portal fees (sometimes per active patient)
  • eRx and EPCS surcharges
  • Lab interface setup and monthly fees per lab
  • Payment processing markups if their billing module is bundled
  • SMS and email fees, often per message
  • Custom form or template build fees
  • API access, which is frequently a separate tier
  • Support tiers (business hours vs. 24/7, response SLAs)
  • Storage overages for imaging or scanned charts

Then add the annual escalator. A 5% annual increase compounds to roughly a 28% higher price by year five. If the vendor won't cap the escalator or tie it to CPI, that's a data point.

Contract term and auto-renewal traps

Read the renewal clause twice, then have your attorney read it. The pattern I see most often: a three-year initial term with automatic one-year renewals unless you provide written notice 90 or 120 days before the end. Miss the window by a day and you're locked in for another year at whatever price the vendor decides.

Negotiate for: a shorter initial term if you can get it, a renewal notice window of 30 or 60 days, and a clear termination-for-cause clause with specific triggers (uptime below a threshold, material breach, data breach, sustained support failures). "For convenience" termination is rare in this space but worth asking for.

Integration reality vs. integration marketing

Every EMR claims to integrate with everything. Push for specifics. If you use a specific compounding pharmacy management system, a specific lab, a specific payment processor, or a specific telehealth platform, ask for the names and phone numbers of two current customers using that exact integration. Then call them.

Questions to ask those references:

  • Is the integration bidirectional or one-way?
  • How often does it break, and how long does it take to fix?
  • Did the integration cost extra, and was that disclosed upfront?
  • Does the vendor's support team actually understand the integration, or do they hand you off?

For compounding practices, the pharmacy interface is often the single most important integration in your stack. If it's flaky, everything downstream (refill speed, patient communication, revenue recognition) suffers.

Security, compliance, and the paper trail

Ask for their most recent SOC 2 Type II report, their HIPAA risk assessment summary, and their BAA. If they can't produce a SOC 2 Type II, ask why. Type I is a snapshot; Type II covers a period of operation and is what you actually want.

Beyond the documents, ask operational questions: Where is the data hosted? Is it encrypted at rest and in transit, and with what key management approach? Who at the vendor can access production data, and under what controls? What's their breach notification timeline, and does it match your state's requirements? For practices handling controlled substances, confirm EPCS certification and the audit logging that comes with it.

None of this is legal advice. Have your own counsel review the BAA and the security addendum. But you should be able to hold your own in the conversation before it gets to them.

Uptime, support, and what "support" actually means

Get the uptime SLA in writing with actual remedies. "99.9% uptime" sounds great until you realize it allows for about 43 minutes of downtime per month, and the remedy is a service credit worth roughly the cost of a coffee. Ask what the vendor's actual uptime has been over the past twelve months, month by month.

For support, get specific:

  • Hours of live support coverage in your time zone
  • Response time SLAs by severity level
  • Whether support is via phone, chat, email, or ticket portal
  • Whether you get a named account manager or a general queue
  • What "P1" or "critical" actually means in their definitions

Then ask three references how long their last support ticket took to resolve. That answer tells you more than any SLA document.

Roadmap credibility and vendor stability

Ask what the vendor shipped in the last twelve months. Not what they announced. What actually reached customers. Then ask what's on the roadmap for the next twelve, and get it in writing if possible, understanding that roadmaps aren't contractual.

Check their financials to the extent you can. Are they venture-backed and burning cash? Bootstrapped and profitable? Recently acquired by private equity? Each of these tells you something different about how the next three years will go. A vendor that just took a large growth round often raises prices and cuts support headcount within eighteen months. A vendor recently acquired by PE often does the same, faster.

Implementation, training, and the first 90 days

Ask for the implementation plan in writing before you sign, not after. It should name the resources on their side, the resources expected on yours, the timeline with milestones, and the go/no-go criteria for cutover. If the plan is a two-page PDF with vague weekly headings, expect the implementation to feel the same way.

Training is where most implementations fail. Ask how many hours per role are included, whether training is live or recorded, whether refresher sessions are available for new hires later, and whether there's a sandbox environment your team can use during onboarding.

The reference call that actually matters

Vendors give you their happy references. Do one more thing: find a practice that left this vendor in the last two years and ask them why. LinkedIn and specialty-specific communities are good for this. The reasons a practice left tell you more about the vendor than the reasons a practice stayed.

If you're evaluating options built specifically for compounding and concierge workflows, you can see how Qintara works and put us through the same audit. We'd rather answer hard questions before you sign than have you regret signing later.

Frequently Asked Questions

How long should EMR due diligence take?

For a small practice, plan on four to six weeks from serious evaluation to signature. For a group practice or one with complex integrations, eight to twelve weeks is more realistic. If a vendor pressures you to sign faster with end-of-quarter discounts, that's a negotiating tactic, not a deadline. The discount will usually reappear.

Should I hire a consultant for EMR selection?

It depends on the size of the decision and your team's bandwidth. For a solo or small group, a consultant is often overkill if you do the homework outlined above. For a multi-provider practice with existing systems to migrate, a consultant who has done this specific transition before can pay for themselves several times over. Make sure they're vendor-agnostic and disclose any referral relationships.

What's the single most common mistake in EMR contracts?

Ignoring the exit terms. Practices negotiate hard on the price and the features, sign a three-year deal, and never read the termination and data export clauses until they want to leave. By then it's too late to negotiate. Treat the exit terms as equally important to everything else on the page.

Can I negotiate an EMR contract, or is it take-it-or-leave-it?

Almost everything is negotiable, especially with mid-market vendors and especially at the end of a sales quarter. Price, term length, renewal notice windows, escalator caps, implementation fees, data export costs, and SLAs have all been negotiated in deals I've been part of. The published rate card is a starting point, not a final offer.