What your AMC should actually include: response-time SLAs, severity definitions, backup verification and compliance updates — not just a number to call.
A typical AMC in this market means: if it breaks, someone will eventually come look at it. That's not a support plan, it's a promise with no timeline attached. A hospital running patient billing and pharmacy dispensing on a system needs to know, in writing, how fast a critical issue gets a response, and needs backups that have actually been tested, not just scheduled.
This gap matters more than most administrators budget for. An AMC line item usually gets negotiated once, at signing, and then forgotten until something breaks at 11 PM on a Saturday and the "24-hour response" clause turns out to mean 24 business hours, not 24 clock hours. The difference between those two readings of the same sentence is the entire point of this page.
| Covered | What it means in practice |
|---|---|
| Response-time SLA | A defined number of minutes/hours by severity, not "as soon as possible" |
| Security patching | OS, database and application patches on a defined schedule, not only after an incident |
| Backup verification | Periodic test-restores, with results logged |
| Compliance updates | GST, e-invoicing and ABDM changes applied without a separate change request |
| CERT-In incident support | Help meeting the 6-hour reporting window if a security incident occurs |
Every row in that table exists because a hospital somewhere learned it the hard way. Response-time SLAs exist because "we'll get to it" during a billing outage means patients wait at the counter with a discharge summary that can't be finalised. Security patching exists because unpatched systems are the entry point in the majority of hospital ransomware cases documented in our hospital ERP data security and CERT-In compliance guide. Backup verification exists because a backup job completing successfully and a backup actually being restorable are two different claims, and only one of them is usually tested.
"Downtime" sounds abstract until it's broken into what actually stops working. None of the figures below are universal constants — get your own numbers from your own patient volume — but the structure of the cost is the same everywhere.
This is why the response-time SLA matters more than almost any other line in an AMC contract. A vendor with a fast patch cycle but a slow support response has optimised for the wrong thing.
There is also a cost that doesn't show up on any single day's ledger: patient trust. A hospital where the billing counter visibly breaks down in front of a waiting room, more than once, acquires a reputation locally that outlasts the actual outage by months. In tier-2/3 markets where word-of-mouth still drives a large share of patient choice, that reputational cost is real even though no accountant will ever put a number against it on a specific invoice.
| Severity | Definition | Example |
|---|---|---|
| Critical | A patient-facing system is fully down | Billing won't load, registration errors on every patient, pharmacy can't dispense |
| High | A department function is degraded but usable | Reports print slowly, one module is intermittent, a specific report is missing data |
| Standard | Configuration requests and non-urgent bugs | Add a new user role, adjust a print template, cosmetic UI issue |
The single most common AMC dispute is a hospital and a vendor disagreeing on which bucket an issue belongs in. Writing the definitions into the contract itself, with examples like the ones above, removes that argument before it starts.
It's worth noting that severity is about impact, not about how loudly a department complains. A single VIP patient's billing glitch and a hospital-wide registration outage can generate the same volume of phone calls to IT, but only one of them is actually critical by the definitions above. Holding to the written definition, rather than to whoever escalated most recently, is what keeps the SLA meaningful under pressure.
If your current vendor can't answer two or more of these cleanly, the AMC is a document, not a service. This is also worth revisiting alongside your broader hospital software pricing evaluation, since AMC terms are frequently where the real total cost of ownership hides, not in the headline licence fee.
| Vendor's responsibility | Hospital's responsibility |
|---|---|
| Patch OS, database, application on schedule | Approve maintenance windows promptly |
| Run and verify backups, including test restores | Confirm which data is business-critical vs archival |
| Update compliance logic when rules change | Flag local rule changes the vendor might not track (e.g. a state-specific KPME requirement) |
| Respond within the agreed SLA by severity | Report issues through the agreed channel, with the agreed detail (screenshots, patient ID if relevant, exact error text) |
| Maintain CERT-In-compliant log retention | Name an internal point of contact for security incidents |
Hospitals rarely need to guess which tier fits. A single-site facility running standard OPD/IPD without a 24/7 ER is usually well served by Standard. A multi-specialty hospital that has completed a phased ERP implementation and data migration and is now running live claims through PMJAY or a private TPA typically needs Priority, since claim-processing downtime has its own financial consequence separate from patient care. Critical-Care tier exists for hospitals where a support gap is not an inconvenience but a patient-safety event.
Vague language is where most AMC disputes start. Here is what each tier should commit to in writing, in actual minutes and hours, not adjectives.
| Severity | Standard tier | Priority tier | Critical-Care tier |
|---|---|---|---|
| Critical | Within 4 business hours | Within 60 minutes, extended hours | Within 15 minutes, 24/7 |
| High | Within 1 business day | Within 4 hours, extended hours | Within 2 hours, 24/7 |
| Standard | Within 3 business days | Within 2 business days | Within 1 business day |
Notice that even the Standard tier has a number attached to every row. "We will prioritise it" is not a commitment a hospital can hold a vendor to; "within 4 business hours" is.
At the point of sale, support is a selling point. Six months after go-live, it becomes a cost centre competing with new-feature development for the same engineering time. This is not unique to any one vendor — it is the natural incentive structure of software support anywhere, hospital or otherwise. The only real defence against it is a contract that ties specific, measurable response times to specific severities, reviewed at renewal, rather than a general goodwill relationship with whichever account manager answered the phone at signing.
This is also why a hospital's own implementation timeline matters for support planning, not just for go-live: the team that trained your staff and knows your specific configuration is the team you want answering critical tickets a year later, not a rotating support desk that has to re-learn your setup from documentation every time.
A planned maintenance window is not downtime in the sense a critical incident is — it is scheduled, communicated in advance, and timed for low patient-impact hours, typically overnight or during a historically quiet period in the hospital's own patient flow data. What should be non-negotiable:
An AMC renewal is the one predictable moment each year to correct drift between what the contract says and what the hospital actually needs. Three things worth revisiting every renewal cycle, not just when something has gone wrong:
The first twelve months after go-live are where a support contract is actually tested, not the sales conversation before it. A realistic pattern for a well-run AMC: a handful of standard tickets in month one as staff settle in, a spike around the first GST rate change or ABDM requirement update that the vendor absorbs without a separate invoice, one or two high-severity tickets tied to unfamiliar edge cases in real patient data, and, if the backup verification process is working, at least one uneventful test-restore drill logged and filed away. None of that requires the hospital to think about the AMC at all — which is the entire point. A support contract that requires constant hospital-side follow-up to get action is not delivering what it was sold as, regardless of what the SLA document says.
AMC pricing in this market is typically quoted as a percentage of the original licence or subscription value, or as a flat per-bed monthly fee layered on top of the core software cost. Neither number, by itself, tells a hospital whether the support behind it is real. The more useful budgeting question is not "what percentage is the AMC" but "what is the cost of one uncovered critical incident, multiplied by how many we're likely to have." A hospital that has never priced out a half-day billing outage tends to under-budget for support and over-budget for features it may never fully use. Anchoring the AMC line item to the downtime costs described earlier on this page, rather than to a generic percentage benchmark, produces a number a finance committee can actually defend.
CERT-In Directions under Section 70B(6), Information Technology Act, 2000 (cert-in.org.in). Central Board of Indirect Taxes and Customs, CGST Rules 2017 (cbic.gov.in).
A proper AMC covers software updates, security patching, backup verification, response-time SLAs for support tickets, and updates to compliance logic when regulations change — not just a phone number to call when something breaks.
For a patient-facing critical issue — billing down, registration down, pharmacy dispensing blocked — response should be measured in minutes, not hours. Non-critical requests can reasonably take longer, which is why tiered plans with defined SLAs matter.
It should. A backup that has never been test-restored is not a verified backup. Managed plans include periodic restore tests, not just confirmation that a backup job ran.
Compliance logic (GST rates, e-invoicing thresholds, ABDM requirements) is updated by the vendor as standard, not as a separate paid change request each time.
Yes. Hospitals commonly start on a standard tier and move up as bed count, department count or claim volume grows enough that downtime risk justifies faster SLAs.
Critical means a patient-facing system is fully down. High means a department function is degraded but still usable. Standard covers configuration requests and non-urgent bugs. Writing these definitions into the contract with examples removes the most common source of AMC disputes.
Ask for the written SLA document, the date and result of the last backup restore test, the patch history for the last two quarters, and whether compliance updates are included or billed separately.
Not for every hospital. A single-site facility under 50 beds without a 24/7 ER can often manage with business-hours support and an emergency escalation path. Round-the-clock coverage earns its cost once a hospital runs multiple high-acuity shifts.
Get an SLA proposal matched to your bed count and department mix.
Talk to OneCity