Guide

The demo script: fifteen questions vendors hope you skip

Summary

An EHR demo script should force answers on five things a sales walkthrough skips by default: full data export in a usable format on request, a signed BAA and where PHI is actually hosted, total cost including every add-on module and per-claim fee, documentation and coding support built into the workflow, and what support looks like when the system goes down mid-session. Ask for each answer in writing, not just spoken during the demo.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

What the demo script is actually testing

A vendor demo is built to show the product working well, on the vendor's data, in the vendor's ideal scenario — the demo script exists to redirect the conversation toward the five things that decide whether the system still works well eighteen months in: data portability, security and the BAA, real total cost, documentation support, and what happens when something breaks. A solo clinician evaluating an EHR alone, without an IT department to catch what a sales deck glosses over, benefits most from asking these as direct questions and getting the answer in writing rather than accepting a confident verbal response.

The questions below are organized by theme rather than as a flat list of fifteen, since a demo rarely covers them in a fixed order — the goal is to have raised each theme by the end of the call, whichever order the vendor's presentation takes.

Data portability: can you actually leave later?

Ask directly: if the practice leaves this EHR in three years, what format does the exported data come in, does it include every note and attachment, and is there a fee attached to getting it out? The 21st Century Cures Act's information-blocking rule prohibits a practice's own EHR vendor from unreasonably interfering with access to that practice's electronic health information, and clinicians are actors under the rule too — a demo is the moment to ask the vendor to describe its export process concretely, not just confirm the rule exists 1Ref 1Office of the National Coordinator / ASTP (2026).Information Blocking.That the 21st Century Cures Act prohibits interfering with access, exchange, or use of electronic health information, and that clinicians are actors under the rule, supporting data-export questions in a demo..

A vendor's stated interoperability also affects who else can be reached from inside the system. TEFCA establishes a national floor for network-to-network exchange through Qualified Health Information Networks, and asking whether a vendor participates — and what that means practically for referrals and records requests — is a fair demo question, not a technical tangent 2Ref 2Office of the National Coordinator / ASTP (2026).TEFCA — Office of the National Coordinator for Health Information Technology.That TEFCA establishes a national floor for network-to-network exchange via QHINs, supporting interoperability questions to ask a vendor during a demo.. This question matters even more than usual heading into any future EHR migration, since export quality determines how painful that migration eventually is.

Security and the business associate agreement

Ask to see the BAA before signing anything else, not after — every EHR vendor handling PHI is a business associate and is required to offer one, and a vendor that hedges on providing it, or treats it as a separate negotiation, is a signal worth taking seriously 3Ref 3HHS Office for Civil Rights (2026).Business Associates.That an EHR vendor handling PHI is a business associate required to offer a BAA, supporting the demo question of asking to see it before signing.. Follow up with where the data is actually hosted, whether it's encrypted at rest and in transit, and who at the vendor can access the practice's data and under what circumstances.

A reasonable follow-up for a solo clinician without a compliance officer: does the vendor's own documentation map to the Security Rule's administrative, physical, and technical safeguards in a way a one-person practice can actually use for its own risk analysis, or does it assume a larger organization's IT staff is doing that translation 4Ref 4HHS Office for Civil Rights (2026).Summary of the HIPAA Security Rule.That the Security Rule requires administrative, physical, and technical safeguards scaled to practice size, supporting questions about whether a vendor's documentation is usable by a solo practice's own risk analysis.?

The real total cost, not the sticker price

Ask for the total monthly cost with every module the practice will actually use turned on — e-prescribing, telehealth, patient portal, billing, secure messaging — since the base subscription quoted early in a demo often excludes several of these as separate add-ons. Also ask about per-claim or per-transaction fees on top of the subscription, contract length and any early-termination penalty, and what a price increase looks like after the first year's promotional rate ends.

The real EHR bill only becomes visible once every one of these pieces is added up, and a demo is the cheapest moment to get that full number in writing — asking after signing means negotiating from a much weaker position.

Documentation and coding support inside the workflow

Ask how the system handles E/M level selection and documentation prompts, since visit levels are determined by medical decision making or total time under the current framework, and a system that doesn't support that documentation cleanly adds real time to every note 5Ref 5Centers for Medicare & Medicaid Services (2023).Evaluation and Management Services Guide.That E/M office-visit levels are selected by medical decision making or total time, supporting the demo question of how a system's documentation workflow handles level selection.. Also ask how the system handles signature authentication — Medicare requires services to be authenticated by a handwritten or electronic signature, and how cleanly a system logs and timestamps that matters more than it sounds during a demo 6Ref 6Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That Medicare requires authenticated handwritten or electronic signatures, supporting the demo question of how a system logs and timestamps signature authentication..

A templated note that looks efficient in a demo can turn out clunky once it's handling a full caseload's variety of presentations — asking to see a template built for the practice's actual specialty, not the vendor's generic example, is a fair request mid-demo.

Support: what happens when it breaks mid-session

Ask what escalation actually looks like if the system goes down while a patient is in the room — is support a phone line, a ticket queue, or a chat bot, what are the stated response times, and is there a live person reachable during the hours the practice actually sees patients, not just business hours in a different time zone. A solo clinician has no second staff member to work around an outage; the support answer matters more here than it would for a practice with a front desk absorbing the disruption.

Ask about the vendor's own uptime history and whether a status page exists, and separately, what happens if the vendor itself is acquired or shuts down — the sunset notice is the moment every EHR contract eventually has to survive, and a vendor that has a stated data-continuity plan for that scenario is answering a question most demos never raise unprompted.

Turning the answers into a written commitment

A demo's verbal answers aren't binding — ask for the export policy, the BAA, the full pricing breakdown, and the support-response commitment in writing before signing, and treat a vendor's reluctance to put any of these in writing as information in itself. This written record is also what a solo clinician compares across vendors after several demos start to blur together, which matters more than it seems when choosing an EHR for one comes down to a handful of finalists that all demoed well.

Keeping each vendor's written answers in one place, alongside notes from the actual demo, turns "which one felt best" into a comparison based on the five things that determine whether the choice still looks good after the first year.

Common questions

Whether the practice can export all of its data, in a usable format, without a significant fee, if it ever leaves the platform. This determines how much leverage the practice has in every other negotiation with the vendor, both now and years later, and it's the question a sales demo is least likely to volunteer without being asked directly.

Yes — asking to see it during the demo, rather than after committing verbally, surfaces any hedging early. A vendor handling PHI is required to offer a business associate agreement, and a vendor that treats it as a later negotiation rather than a standard document is worth noting as a signal, not just a delay.

Ask each vendor for the same itemized list: base subscription, every module the practice will actually use, per-claim or per-transaction fees, and what happens to the price after any first-year promotional rate ends. Comparing only the headline monthly number hides which vendor is actually cheaper once every practice-specific module is turned on.

Ask what escalation looks like during an outage while a patient is in the room, what the stated response times are, and whether a live person is reachable during the hours the practice actually sees patients. A solo clinician has no second staff member to absorb a support gap, so this answer carries more weight than it would for a larger practice.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Office of the National Coordinator / ASTP (2026). Information Blocking. HealthIT.gov. link ✓That the 21st Century Cures Act prohibits interfering with access, exchange, or use of electronic health information, and that clinicians are actors under the rule, supporting data-export questions in a demo.
2.Office of the National Coordinator / ASTP (2026). TEFCA — Office of the National Coordinator for Health Information Technology. HealthIT.gov. link ✓That TEFCA establishes a national floor for network-to-network exchange via QHINs, supporting interoperability questions to ask a vendor during a demo.
3.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkThat an EHR vendor handling PHI is a business associate required to offer a BAA, supporting the demo question of asking to see it before signing.
4.HHS Office for Civil Rights (2026). Summary of the HIPAA Security Rule. U.S. Department of Health and Human Services. linkThat the Security Rule requires administrative, physical, and technical safeguards scaled to practice size, supporting questions about whether a vendor's documentation is usable by a solo practice's own risk analysis.
5.Centers for Medicare & Medicaid Services (2023). Evaluation and Management Services Guide. CMS Medicare Learning Network (MLN006764). link ✓That E/M office-visit levels are selected by medical decision making or total time, supporting the demo question of how a system's documentation workflow handles level selection.
6.Centers for Medicare & Medicaid Services (2023). Complying with Medicare Signature Requirements. CMS Medicare Learning Network (MLN905364). link ✓That Medicare requires authenticated handwritten or electronic signatures, supporting the demo question of how a system logs and timestamps signature authentication.

https://www.gale.care/for-providers/spc-ehr-demo-script · 6 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers