Read the exit before the demo: export, notice, escalators, and PHI return

What should you check first in a practice software contract?

Check the exit first. Four clauses decide what leaving a practice software contract costs: how your patient data comes out, how much notice a cancellation takes, how far the price can climb at renewal, and what the vendor does with protected health information once the relationship ends. Everything else in the document describes the product; those four describe leaving it.

The notice window is the one that varies by state. The federal statute covering a subscription sold over the internet requires the seller to disclose material terms clearly before it takes billing information, to obtain express informed consent to the charge, and to give the buyer a simple mechanism to stop future charges, and it sets no notice window at all 1Ref 1United States Congress (Restore Online Shoppers' Confidence Act) (2010).15 U.S. Code § 8403 — Negative option marketing on the Internet.The federal baseline for a recurring charge sold over the internet (clear and conspicuous disclosure of material terms before billing information is taken, express informed consent before the first charge, and a simple mechanism to stop future charges), and that it sets no notice-window day count.. The days you owe come from your state's automatic renewal statute, if it has one, and from the clause in front of you.

Read the contract backward, starting at termination. The habit that pays off when reading a payer contract pays off here: the money sits in the clauses nobody demos, and a vendor's summary of its own exit terms is a starting point rather than an answer.

Can you get your patient data out without the vendor's help?

Sometimes, and it depends on whether the product is certified health IT. A certified electronic health record must let a user create an export file with all of one patient's electronic health information on demand, without the developer's help, and separately export the entire patient population 2Ref 2Office of the National Coordinator for Health Information Technology (ASTP/ONC), U.S. Department of Health and Human Services (2020).§ 170.315 ONC Certification Criteria for Health IT.The technical export capability of certified health IT: a user, unassisted by the developer, can export one patient's full stored electronic health information on demand and separately export the entire patient population's, in electronic computable format.. A scheduling tool, a patient portal or a superbill generator carries no such duty. Its contract is the only thing that owes you anything.

Ask for the export during the demo. A sales engineer can produce a sample export for a test patient in about the time it takes to answer a pricing question, and what comes back tells you more than any answer would: a computable file with its fields named, a folder of PDFs, or an offer to discuss migration when the time comes.

The criterion reaches electronic health information and nothing beyond it: not your appointment templates, your saved fee schedule, your report definitions or the letters you built over three years. Those follow you out only if the contract says so.

So put three things in the agreement, since certification speaks to what the product can do and not to what you will be charged: the export format, the window in days from request to delivery, and the price, including the price of an export requested after termination. That last one is the easiest to leave out.

What if the vendor slow-walks the export?

Then you are in the territory the rule calls information blocking. The regulation defines it as a practice likely to interfere with access, exchange or use of electronic health information, unless the practice is required by law or fits a listed exception 3Ref 3Office of the National Coordinator for Health Information Technology (ASTP/ONC), U.S. Department of Health and Human Services (2020).§ 171.103 Information Blocking.The regulatory definition of information blocking, its required-by-law and listed-exception carve-outs, and the differing knowledge standards applied to developers versus health care providers.. The knowledge standards differ by actor: a developer is judged on what it knew or should have known, a clinician only on what it knew 3Ref 3Office of the National Coordinator for Health Information Technology (ASTP/ONC), U.S. Department of Health and Human Services (2020).§ 171.103 Information Blocking.The regulatory definition of information blocking, its required-by-law and listed-exception carve-outs, and the differing knowledge standards applied to developers versus health care providers..

Three kinds of actor sit under the rule: health care providers, developers of certified health IT, and health information exchanges and networks 4Ref 4Office of the National Coordinator / ASTP (2026).Information Blocking.That the information blocking rule reaches three categories of actor, clinicians and developers of certified health IT among them, so the reader sits under the same rule as the vendor.. You are one of them, which cuts both ways. The same rule that constrains a vendor sitting on your export governs how fast you answer a records request from a patient or from the practice taking over their care.

OIG may impose a civil monetary penalty of up to $1,000,000 per violation on a developer, exchange or network found to have committed information blocking 5Ref 5U.S. Department of Health and Human Services, Office of Inspector General (OIG) (2023).Information Blocking.The developer-side penalty ceiling: OIG may impose a civil monetary penalty of up to $1,000,000 per violation on a health IT developer, health information exchange or network found to have committed information blocking.. That number is not yours to collect, and quoting it in an email speeds nothing up. It explains why a vendor's counsel tends to answer a written question about export timelines that its sales team let sit.

But leverage in a dispute is worth less than a clause in the contract. Get the export window in writing before signing, and get it as a duty rather than a best effort.

What happens to the PHI the vendor still holds?

It comes back or it gets destroyed, if the vendor is your business associate and the agreement does what the Privacy Rule requires. A business associate contract must require the vendor to return or destroy all protected health information it holds when the contract ends. Only where that is not feasible may it instead keep the contract's protections in force and limit further use to the purposes that make destruction infeasible 6Ref 6U.S. Department of Health and Human Services (2026).45 CFR 164.504 - Uses and disclosures: Organizational requirements.What a business associate contract must say about the end of the relationship: return or destruction of all PHI the vendor holds, and the narrow infeasibility branch that extends the contract's protections instead..

A vendor holding every customer's data in one indexed backup will tell you that carving a single practice out of it is not feasible, and the second branch lets that answer stand as long as the protections continue and further use stays limited. It is the sentence to read slowly, because a contract can write the exception in as the default.

Two questions settle it, and both belong in the agreement rather than the sales thread. What triggers the obligation: termination alone, or termination plus a written request from you? And what evidence do you get that it happened? A dated certificate of destruction is a common thing to ask for.

Notice windows, auto-renewal and the price escalator

These three clauses work together and get read apart. The renewal clause sets when the term rolls over, the notice clause sets how long before that date you have to say no, and the escalator sets what the next term costs. A generous notice window buys little if the escalator is uncapped, because the vendor gets to set next year's price after your schedule has moved in.

One federal rule that would have said more was struck down. The FTC's 2024 amendments to the Negative Option Rule, the click-to-cancel package, were vacated in full by the Eighth Circuit on July 8, 2025, before their compliance date 7Ref 7United States Court of Appeals for the Eighth Circuit (2025).Custom Communications, Inc. v. Federal Trade Commission.Cited as history only: the Eighth Circuit vacated the FTC's 2024 click-to-cancel Negative Option Rule amendments before their compliance date, so they are not a current obligation on a software vendor.. Treat that as history if it turns up in a vendor's compliance page. What is live is the federal statute above, your state's automatic renewal law if it has one, and the clause you are about to sign.

Where a state has an automatic renewal statute, that is where the day count lives, and the counts differ from state to state, which is why no single number belongs in an article like this one. Look up whether your state has one, then read the notice clause: how many days, delivered how, to which address, and whether an email to a support queue counts.

The escalator is usually left to the renewal invoice. Ask for a cap on the increase at each renewal, written as a percentage in the contract, and ask what happens to the price if you drop a seat or close a location. As asks go, a renewal cap is one of the easier ones.

The clauses to mark up before you sign

Mark up five clauses and let the rest go. In roughly the order they will cost you: data export, with its format, window and price; return or destruction of PHI, with evidence; the notice window and the method notice has to take; the renewal escalator, with a cap; and the price of growth, meaning the second user, the second location and the interface to whatever you add next.

Keep an exit-clause inventory for the practice: one page listing every tool that touches patient data, its renewal date, its notice deadline, and where its export comes from. Four tools is enough to lose a renewal date. It also tells you what the next contract has to match when you are buying the stack in order, and it keeps the spreadsheet-vs-software test honest, since the cheapest exit clause belongs to the tool nobody bought.

Counsel earns its hour on a short list of facts: a multi-year term, an auto-renewal with a short notice window, a termination-for-convenience right running only toward the vendor, or an indemnity clause that reaches your patient records. Send the marked-up copy back while the trial is still running.