Guide · Uganda

What happens to your clinic when the internet goes down

Not if. When. The power blacks out and the inverter is flat. A fibre cable gets cut somewhere up the road. Your network provider simply lets you down. The question was never whether it happens — it is what your queue does for the next two hours. CareBoon keeps going.

For most clinic software the honest answer is: it stops. The screen says "no connection", and a receptionist with four people in front of her reaches for an exercise book. That is not a small inconvenience. It is the moment your records split in two — some in the system, some on paper — and the reconciling afterwards is work nobody has time for, so it does not fully happen.

The dangerous part is not the queue. It is the chart.

A clinic can absorb a slow morning. What it should not absorb is a nurse about to give an injection who cannot open the patient's allergy list, because the allergy list lives on a server she cannot reach.

This is the failure worth designing against, and it has a particular shape: staff will keep working regardless. They will give the drug. Whether they do it knowing or guessing is decided months earlier, by whoever chose the system.

What "works offline" has to mean

The phrase gets used loosely, so here is a concrete test. During an outage, can the clinic still:

Read — who is in the building, what they are allergic to, what they are already taking, what came back from the lab, and what things cost?
Take a new patient — someone walks in during the blackout. Can they be registered and triaged, or do they go on paper?
Take money — and against the right bill, not a guess?
Do the clinical work — write a consultation, order a test, record a result, prescribe, dispense?
Recover cleanly — when the line returns, does everything land exactly once, even if a phone tried to send it three times?

That last one decides whether the feature is real. Queuing work offline is easy. Replaying it without giving a patient a second dose, a second bill or a second medical record is the hard half, and it is the half that is usually missing.

What CareBoon does

With no connection at all, everyone already in the building keeps moving. Whoever is waiting for triage gets triaged. Whoever is at the cashier can pay, against their real bill rather than a guess. The doctor consults, orders tests and prescribes; the bench records a result; the imaging room reports a scan; the pharmacy dispenses. Each station carries on with the patients in front of it.

Someone who walks in during the outage is registered and triaged on the spot — so they are captured rather than scribbled on paper — and they join the queue proper the moment the connection returns. Being honest about the order here matters: the cashier and the doctor pick that patient up once the line is back, because until then their record has not yet reached the system the rest of the clinic is reading from.

Each device keeps a copy of what today needs — the people currently in the building, their allergies, their drug chart, where they are in the queue, results already back, what they owe, and the price list. Nothing about patients who have gone home.

That copy is encrypted with a key built from a PIN the staff member chooses. The key is not stored anywhere; it is rebuilt from the PIN each time. A tablet that leaves the building gives up nothing readable, and signing out at the end of a shift destroys the copy entirely.

When the connection returns, everything recorded is sent automatically. Each entry carries an identifier created before the first attempt, so a phone that cannot tell whether its last message arrived is free to send it again — and it lands once. One dose on the chart. One line on the bill.

The allergy check deserves its own sentence, because it is the reason any of this matters. It runs on our server, and the answers for the patients in your building are carried on the device — so a drug someone is allergic to is refused during a blackout, not after it. When the line comes back the check runs again against the current record, and anything it disagrees with is handed back to the clinician rather than quietly saved.

Ask a vendor these four questions

Turn the wifi off. Now register a new patient. Not "show me the cached page" — actually add someone who has just walked in. Most systems cannot, because their offline mode only covers the screen you already had open.
Still offline, open a patient's allergies. If it cannot, ask what a nurse is supposed to do at four in the afternoon during a power cut.
Submit the same thing twice and reconnect. Then count the rows. If you get two, that will one day be two doses or two charges.
What is on the device, and what happens if it is stolen? Anything kept offline is kept somewhere. A vendor who has not thought about that has not built it carefully.

What it will not do: it will not walk a brand-new patient through the whole clinic during a single blackout. They are registered and triaged; the cashier, the doctor and the pharmacy pick them up when the line returns. Mobile-money confirmation needs the network — cash does not, and the till still records the bill exactly. A scan taken during an outage is reported straight away but the image is attached once the line is back. And the copy on a device expires: fresh for half a day, shown with a warning for up to three days, then cleared. Old clinical information presented as current is worse than none, so we would rather show you its age than let you assume.

Start free See what it costs