The verdict in three sentences
For a rehabilitation centre in New York running hundreds of physical, occupational and speech therapy sessions a day, a solid maintenance contract costs about USD 1,000 to 5,000 a month as a 2026 market ballpark, on top of HIPAA-ready hosting at USD 600 to 3,000. The right tier depends on one number: what does a morning without the schedule cost you in lost billable sessions? Sign only a contract that spells out response times by severity, an uptime commitment, the development days included and a tested exit procedure.
Three service tiers side by side
| Contract item | Essential | Standard | Enhanced |
|---|---|---|---|
| Monthly fee (market ballpark) | USD 1,000 to 1,800 | USD 1,800 to 3,000 | USD 3,000 to 5,000 |
| Support hours | weekdays, 9 am to 6 pm ET | weekdays, 7 am to 8 pm ET | 24/7 on-call line |
| Response to a blocking incident | 8 business hours | 4 hours | 1 to 2 hours |
| Uptime commitment | 99.5% | 99.8% | 99.9% |
| Development days per year | 5 days | 10 days | 20 days |
| Security patching | quarterly | monthly | as soon as fixes ship |
| Restore test | yearly | twice a year | quarterly |
A 99.5% commitment still allows roughly 3.6 hours of downtime a month, which can mean a whole morning of sessions. If you run Saturday clinics, Essential leaves a gap.
Response times by severity
| Severity | Concrete example | Response | Target resolution |
|---|---|---|---|
| Blocking | therapists cannot open the schedule | 1 to 4 hours | same day |
| Major | sessions fail to sync to the EHR for billing | 4 to 8 hours | 1 business day |
| Minor | wrong room shown for an aquatic therapy slot | 1 business day | 5 business days |
| Change request | new group session type | 5 business days to quote | agreed schedule |
| Security | vulnerability reported in a library | 4 hours | patch within 72 hours |
| Data restore | a week of appointments deleted by mistake | 2 hours | from the previous night's backup |
The EHR sync deserves its own line: if completed sessions do not reach the EHR, they are not billed, and the cost lands straight on your revenue cycle. Ask for service credits, a capped percentage of the monthly fee, when targets are missed repeatedly.
What the contract must include
| Clause | What to require | Indicative cost |
|---|---|---|
| Business Associate Agreement | signed BAA with the vendor and its hosting provider, as HIPAA requires | no extra fee from a serious vendor |
| HIPAA-ready hosting | named cloud provider, encryption at rest and in transit, access logs | USD 600 to 3,000 per month |
| Backups | daily, encrypted, kept at least 30 days | usually bundled with hosting |
| Monitoring | automatic alert if the schedule stops responding | USD 50 to 250 per month |
| EHR interface upkeep | adaptation when the EHR vendor changes its API | 2 to 6 days per year |
| Exit and data return | full export of data and code in a documented format | 2 to 5 billable days |
Test the exit clause once in the first year: request a full export and check that another developer could use it.
Mini case study
Illustrative example: Daniel, executive director of a 90-bed inpatient rehabilitation centre in Queens, schedules 400 sessions a day. Last year, three blocking incidents each wiped out a full day. Cost per incident: 28 therapists losing 2 hours at USD 55, USD 3,080, plus 80 sessions not delivered at USD 110 of revenue each, USD 8,800, so USD 11,880 in total, or USD 35,640 for three incidents. Moving from Standard at USD 2,400 a month to Enhanced at USD 4,000 adds USD 19,200 a year. If a 2-hour response cuts each incident to half a day, the loss falls to USD 17,820: the USD 17,820 saved covers over 90% of the extra cost, before counting the 10 extra development days.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Does the original developer have to maintain the software?
No, but it is usually the most efficient choice in year one. A new vendor typically needs 5 to 15 days of handover and documentation work before taking over.
Is a BAA really necessary for a scheduling tool?
If the schedule holds patient names, diagnoses or session notes, it handles protected health information and HIPAA requires a BAA with every vendor touching it. Refuse any vendor that hesitates; signing costs a serious provider nothing.
How many development days should we budget?
For a 90 to 120 bed centre, 10 days a year usually covers new session types and EHR changes. Beyond 20 days, a separate development budget is easier to manage.
What uptime should we ask for?
99.8% is a reasonable 2026 baseline for a daily clinical schedule, about 1.5 hours of downtime a month. 99.9% makes sense if you run extended hours or weekends.
How do we avoid surprises when the contract ends?
Write an exit clause with a defined export format and a capped fee, for example 2 to 5 days. Run a test export within the first 12 months.
Let's scope your project. Share your software, session volume and opening hours, and we will propose the right service tier with its monthly cost and response times. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
