6 Questions If Your Resident Records Have to Survive an Outage

Massachusetts now requires certified assisted living residences to keep an electronic copy of every resident record and to make it reachable remotely during an emergency, by January 1, 2027. Colorado requires much the same outcome and never names a single piece of technology. If you only watch for rules that say "electronic," you will miss the one that says "readily available."

That is the pattern worth planning around, and it is why this is not a Massachusetts article. Two states have arrived at the same operational obligation from opposite directions. One wrote the technology into the text with a date attached. The other described the result and left the method entirely to you. Both land on the same question: when the building is dark, can anyone open a resident's record. For the wider frame, start with what business continuity actually means for a senior living community.

One honesty note before the list. We verified two states against their own primary sources. Two is a pattern, not a trend, and we are not going to call it a national wave because we have not checked forty-eight other rulebooks. Plan around it because it is operationally right, not because everyone is doing it.

What Massachusetts Actually Says

The source is 651 CMR 12.00, Certification Procedures and Standards for Assisted Living Residences, published by the Massachusetts Executive Office of Aging and Independence. The version checked is the one dated July 31, 2026, read from the Commonwealth's own regulation library on September 1, 2026.

The operative sentence sits in 651 CMR 12.05, Record Requirements:

"By January 1, 2027, the Residence must maintain an electronic copy of the Resident's records, including the Resident's Service Plan, and ensure that the electronic record is accessible remotely during an emergency."

Two things in that sentence do more work than they appear to. "Maintain an electronic copy" is a storage obligation. "Accessible remotely during an emergency" is an availability obligation, and it is the harder one, because the emergency is exactly the moment your normal path to the record may be the thing that broke.

There is a second requirement most summaries miss, and it is in a different section. 651 CMR 12.04 governs the emergency plan itself, and it states that the plan "must provide a means for the Residence to be able to remotely access copies of the Residents' records electronically, such as during an emergency."

Read those together and the obligation is doubled. One rule says the capability must exist. The other says the written plan must say how. A community that quietly has remote access but never wrote it into the emergency plan has satisfied one and not the other.

Worth noting for context: January 1, 2027 is a busy date in this regulation. The same deadline carries new Resident Care Director qualification requirements and a rule that at least one staff member certified in CPR and AED use be available at all times. The records requirement is not arriving alone.

Colorado Requires the Same Outcome Without Naming It

We read Colorado's chapter in full for a separate piece on its IT questions, and the contrast is the useful part. 6 CCR 1011-1 Chapter 7, effective July 1, 2025, runs 83 pages and uses the words network, internet, backup, and password exactly zero times. It uses "readily available" 15 times.

Two of its rules land in the same place Massachusetts does. Rule 10.1 requires a community to keep "readily available a roster of current residents, their room assignments and emergency contact information, along with a facility diagram showing room locations." Rule 12.33 requires that staff who accompany residents away from the residence have "ready access to the pertinent personal information of those residents in the event of an emergency."

That second one is remote access to resident data, required, described without a single technical word and with no security standard attached to it. Massachusetts says the same thing in the vocabulary of 2026. Colorado says it in the vocabulary of a rule that expects a binder.

The Six Questions, Ordered by How Soon You Would Need the Answer

These are ordered the way an actual emergency would ask them: the first one you need in the first ten minutes, the last one you need the week the surveyor arrives.

1. Tonight, from a parking lot: can anyone open a resident's service plan?

This is the whole requirement in one test, and it takes one phone call to run. Ask someone on your team to open a resident's current service plan from their own phone, standing outside the building, without using the building's Wi-Fi.

If the answer is yes, note who can do it and move to question two. If the answer is no, you have found the gap that Massachusetts has put a date on and Colorado has been implying for years. It is worth knowing now rather than during an evacuation.

2. Within the hour: is there a current roster that does not need the network?

Colorado's Rule 10.1 wants the roster, the room assignments, the emergency contacts, and the facility diagram readily available. Rule 10.6(A) goes further and requires written emergency instructions to be available "24 hours a day in more than one location with all staff aware of the locations."

"More than one location" is the rule writing redundancy into itself. A single shared drive is one location. A shared drive plus a printed copy in a binder at the front desk is two, and the second one works when the first does not. Print it, date it, and put a recurring reminder somewhere to reprint it, because a roster from March is worse than no roster at all.

3. Within a day: if the system itself is what failed, is there still a copy?

This is the question that separates a real answer from a comfortable one, and it is where most communities are exposed.

Remote access assumes the record system is running. If the outage is the record system, or ransomware encrypted it, or the circuit serving your building is the failure, then remote access to that system returns nothing at all. Reaching a record from somewhere else and having a copy that survives the system being down are two different capabilities. Most communities have bought the first and assume it covers the second.

The plain version of the question for your provider: if our record system were unavailable for 48 hours, what exactly would we be able to open, and where does it live? For what a full outage costs while it is happening, see what happens when a senior living community loses internet for 24 hours.

4. Within a week: does your emergency plan say, in writing, how records get reached?

This is 651 CMR 12.04, and it is the requirement that gets missed because it does not live with the other records rules. The plan itself has to provide the means. Capability without documentation satisfies the technology and fails the plan.

It is also the cheapest item on this list. If the capability from question one already exists, writing down who can do it, how, and from what device is an afternoon of work, not a project.

5. Before your next survey: who holds remote access, and can you show the list?

Here is the uncomfortable second half of a remote-access requirement. The moment resident records are reachable from outside the building, the list of people who can reach them becomes a control that matters, and it is the list nobody maintains.

Ask for it in writing: every account that can open resident records from off site, who each one belongs to, and when it was last reviewed. If a name on that list left in March, you have found something worth more than the exercise cost. Our IT offboarding checklist for senior living staff covers the process side of keeping that list honest.

6. Over six years: can you still open the oldest record you are required to keep?

Massachusetts requires resident records to be kept for the duration of the stay and "for at least six years after the date of termination of the Agreement." Colorado's Rule 18.12 requires three years for former residents, and Rule 18.13 requires those records "maintained and readily available at the assisted living residence location for a minimum of six (6) months" after move-out.

Retention and readability are not the same obligation. A file kept in a format nothing opens any more, or in a system you stopped paying for two vendors ago, is retained and not available. If you have changed record systems in the last six years, the honest question is whether anyone has opened a record from the old one since the migration.

What To Do With This

Four of the six can be checked this week and none of them costs anything.

• Have someone open a current service plan from their phone, outside the building, off your Wi-Fi. That is question one, and it takes five minutes.
• Print today's resident roster and facility diagram and put them somewhere that is not the network. Then say the second location out loud.
• Ask your IT provider one written question: if the record system were down for 48 hours, what could we open and where does it live?
• Ask for the list of accounts that can reach resident records from off site, and read the names.

The two that take longer are the ones with judgment in them. Writing the means into the emergency plan is an afternoon but it needs someone accountable to sign it. Confirming you can still open a six-year-old record may surface a migration nobody finished, and that is better found now than in front of a surveyor.

If you operate more than one community, run question one at every building before you do anything else. In most portfolios the answer differs by site, because one building got a new record system in a good year and another did not, and nobody has compared them since. A deadline with a date on it is the cheapest reason you will ever get to make the answer the same everywhere.

Frequently Asked Questions

What does Massachusetts require for assisted living resident records?

651 CMR 12.05 states that by January 1, 2027, the Residence must maintain an electronic copy of the Resident's records, including the Resident's Service Plan, and ensure that the electronic record is accessible remotely during an emergency. The same regulation requires resident records to be kept for the duration of the stay and for at least six years after the agreement ends. This is the version of 651 CMR 12.00 dated July 31, 2026, published by the Massachusetts Executive Office of Aging and Independence.

Does the requirement apply outside Massachusetts?

The January 1, 2027 deadline is a Massachusetts rule and binds Massachusetts certified assisted living residences only. Colorado reaches a similar operational result by different means. 6 CCR 1011-1 Chapter 7 never uses the words network, internet, or backup, but Rule 10.1 requires a resident roster and facility diagram to be readily available, and Rule 12.33 requires staff who accompany residents away from the residence to have ready access to their personal information in an emergency. We verified two states. That is a pattern worth planning around, not a national trend.

Is remote access to the electronic health record enough?

Not on its own, and this is the most common gap. Remote access assumes the record system is running. If the outage is the record system itself, or ransomware encrypted it, or the internet circuit serving the building is the failure, then remote access to that system returns nothing. Reaching a record from elsewhere and having a copy that survives the system being down are two separate capabilities, and most communities have only bought the first.

Does an emergency plan have to say how records get reached?

In Massachusetts, yes. Separately from the records rule, 651 CMR 12.04 requires that the emergency plan must provide a means for the Residence to be able to remotely access copies of the Residents' records electronically, such as during an emergency. That places the obligation in the written plan, not only in the technology, so a community that has the capability but has not documented it has met one requirement and not the other.