Ideally your site has some type of "early adopters" who would have an opportunity to test-drive any software maintenance, including SAS and especially consideirng the varied components and capabilities the SAS product suite provides to an enterprise. Of course, the amount of time invested with suitable testing and follow-on re-testing is an unknown and must be weighed on merits related to any particular software vendor and their track-record.
I'd suggest that you will want to propose, develop, maintain and execute some type of SAS software maintenance/fix/upgrade initiative and methodology document -- one that is well-aware by your mgmt, with written concurrence.
We do it for all SAS products on an AS NEEDED basis. We do this for two reasons:
-- most of our work is done under 21 CFR 11 regulations (FDA), which requires running validations after any change to the system. So we have to re-run the validations after any hotfix application. EGuide is a little "easier" because it doesn't do any processing on it's own.
-- we have been burned with hotfixes that broke something that worked (see Steve's comment about early adopters). For instance, one hotfix broke the EGuide 4.1 "e-mail as a step in the project" task and we had to roll-back a couple of levels to fix it.