Why Now
The Deadlines Are Real This Time
Every community hospital has one — the old EHR kept alive for record lookups, the retired ERP nobody dares unplug, the departmental system with seven users and a five-figure maintenance renewal. The data inside is subject to retention rules measured in decades, so the servers stay on.
The calendar is now forcing the issue. Infor Lawson 10.0.x — the ERP running payroll and general ledger in hundreds of hospitals — reaches the end of mainstream support in December 2027. MEDITECH hospitals moving to Expanse are discovering that business and financial data doesn't always make the trip. And every year a retired system goes unpatched, it drifts further from your security baseline while still holding protected health information.
The stakes aren't abstract. IBM's 2025 Cost of a Data Breach report puts the average healthcare breach at $7.42 million — the most expensive of any industry — with 279 days to identify and contain. An unpatched legacy system holding PHI is exactly the kind of quiet exposure those numbers are made of.
Retention
What You Actually Have to Keep — and for How Long
Retention is set by state law and federal program rules, not by HIPAA. The ranges below are common requirements — confirm your own state's schedule with counsel.
| Most states | 6–10 years for adult medical records |
|---|---|
| Massachusetts | 20 years after discharge |
| Washington | Up to 26 years for some records |
| Minors | Commonly age of majority plus 3–10 years — often the longest clock in the building |
| Medicare (CMS) | Federal floor of 5 years for hospital records |
| HIPAA | Sets no medical-record retention period at all — a common misconception; it governs privacy and security, not how long you keep charts |
The practical consequence: whichever rule is longest in your state sets the clock for the whole archive — and for records involving minors, that clock can run past twenty-five years. Keeping a legacy system alive that long is not a retention strategy. Archiving is.
The Playbook
Archive First, Then Decommission
The projects that go wrong skip steps two and three. The ones that go right follow all five, in order.
1. Inventory Every System and Obligation
List each legacy application, what data it holds, who still signs into it, and the retention rule that applies to each record type. Most hospitals find systems on this list that nobody has opened in a year — but that still carry a maintenance contract.
2. Extract and Archive in Original Format
Move the data into an archive that preserves records exactly as the source system stored them. Original-format retention is what keeps the archive defensible for audits, litigation holds, and release of information.
3. Validate Completeness
Reconcile record counts and spot-check patient charts, pay stubs, and financial reports against the source system before anything is turned off. Validation is the step that makes the rest of the project reversible-proof.
4. Go Live with View-Only Access
Give HIM, billing, HR, and compliance staff one place to search, view, and report on every archived record. Run it alongside the legacy system briefly if it builds confidence — the archive should stand on its own quickly.
5. Decommission and Stop Paying
Cancel the vendor maintenance contract, retire the servers, and close the security exposure of an unpatched system. This is where the savings start — and they recur every year.
Evaluation
What to Require in an Archiving Solution
Bring this list to every vendor conversation — including one with us.
- Records preserved in their original format — not transformed into a proprietary store
- One search across every archived system, with each record tagged to its source
- Patient, employee/payroll, and financial/ERP data as first-class domains
- Release of Information packets and system-specific (MRN) reports in seconds
- Deny-by-default role-based access mapped to real hospital jobs
- A full audit trail that records the originating IP of every event
- Two-factor authentication and SAML/OIDC single sign-on
- Per-tenant isolation — your data never shares a database with another hospital's
- Pricing a community hospital budget can absorb — not an IDN price tag
Built for Your Scale
Why Community Hospitals Need a Different Answer
Most archiving vendors design and price for integrated delivery networks — big migration teams, big timelines, big invoices. A 25-bed critical access hospital retiring two systems doesn't need any of that. It needs the data moved safely, staff who can find a chart on day one, and a bill that fits the budget a board will approve.
That's the gap CHA built Viewer for. We've spent our careers inside community, critical access, and rural hospitals — as CIOs and consultants — and the archive reflects it: one login, view-only access to every retired system, reports your HIM team can run without a ticket, and security your compliance officer can defend.
Ready to Retire a Legacy System?
Schedule a demo of CHA Viewer, or bring us your system inventory and we'll help you build the decommissioning plan.