Name: Know the Unknowns: Hidden Risks in Legacy Data and How CIOs Defuse Them
Uploaded: 2026-05-14T17:16:16.026Z
Duration: 37 min 48 s
Description: Know the Unknowns: Hidden Risks in Legacy Data and How CIOs Defuse Them

Transcript for "Know the Unknowns: Hidden Risks in Legacy Data and How CIOs Defuse Them": Hello, everybody, and welcome. I'm Jamie Greenstein from Access, and I am thrilled to be the guide for today's discussion. Today, we are exploring a topic that almost every health care organization struggles with at some point, the hidden risks, surprises that live inside legacy systems. So without further ado, I'm gonna have our two amazing speakers introduce themselves. Welcome, Brian. Thank you for joining us. Yeah. Thank you, Jamie. Excited to chat a little bit about this issue for a little while with you guys. So Brian Sterud. I'm the chief information officer at Faith Regional Health Services located in Norfolk, Nebraska. We're a regional health system in in Northeastern Nebraska. I cover a pretty big geography in that part of the state. Very rural. So in hospital and multi specialty physician practices and delivering care across a great part of the country and a very rural part of the country. And I'm happy to be here to talk about some of the things we've done with our transition. Welcome. Thank you. And Sudhakar, welcome. Thanks for joining us today. Yeah. Thank you, Jamie. My name is Sudhakar Mohan Mohanraj. I'm the CTO at Access Unify Health. Over the last twenty years, I've been in health care IT working on developing electronic health records, revenue cycle solutions. I'm implementing it with various hospitals across the country. Over a decade ago, I founded Triumph, a health care data archival company. Trium was a disruptor on the health care data management space. And since inception, Trium has completed over 500 projects helping archive records more than almost 60,000,000 patients through our SaaS platform. Prime is now part of AccessCorp. AccessCorp is the largest private record management company in the world, and I'm happy to be part of Access team and working on setting the product road map. So let's set the stage a bit in terms of a legacy system and what counts as a legacy system. So, Brian, I'm curious from your perspective, when you think about legacy systems, what does that mean to you? Yeah. I think legacy systems oftentimes can mean older system. It could mean a system that's no longer supported or a system that no longer is receiving updates, those sorts of things. Within the context of an archival project though, it's really any system that you will no longer be using. So while we may have had systems that were still up to date, we're still receiving updates, we're still all of those things, they were systems that we were no longer going to be using going forward. And in that context, in the context of an archival project, those are those systems that you are leaving behind and then need to archive data off of them and long term discontinue using. That makes perfect sense. I'm gonna dive into these discussion questions here. Assumptions versus reality. Brian, you mentioned a little bit about a project we're gonna talk about at Faith Regional Health Services, and your team went in with assumptions about what's inside those older systems. So before that project even began, what were those assumptions in terms of when the work started, how did they turn out to be different from what your team expected them to be? Yeah. I think when you go back to the way in the beginning, there's a number of things that are assumed, and, certainly, you can uncover information along the way. So we were on it was pretty obvious as it relates to our inpatient EMR and our ambulatory EMR. We were on Sorian Clinicals and we were on NextGen, and those were very obvious. Those were very clear. We knew those were systems that we would be vacating. We knew those were systems that would need to be archived. What was interesting was the number of almost little sort of other pockets of information or systems that also were needed. Things like a legacy home health EMR. Things like we actually had a through an acquisition, we had a an ambulatory EMR that was used for from an OB practice. So you really start to uncover when you really think about all the things that need to be archived in a process like this. You uncover things that you forget about almost. And even an organization our size, we're not a humongous organization. You still end up with a fairly long list of different things that are needed to be archived. And the other part of it is making sure that you have the right data retention and all the details that go into what should be extracted and how should it be extracted and what should we retain. All those things go into it. It's a very much a project that needs to be done in concert with a lot of folks in the organization, one of them being HIM representation as well because it impacts their life on a day to day basis. So from a sense of urgency in the triggers that are impacting your organizations as they wait to think about archival until they've really gotten into a new EHR system. What was the case for Faith Regional Health Services? If you could go back in time, for instance, and start over, what would you do differently to reduce those risks or those unknowns, if you will? Yeah. I think at the risk of appearing too confident, one of the things that we did well was planning for the timeline of this transition. So we knew we had a contract that was coming towards an end. We knew then working backwards from that. So, again, this was a we were a hosted customer. Those hosting fees and all those sorts of things, as soon as that contract ends, they are no longer. Right? So definitely had working backwards from the end of that contract, needed to make sure that we had everything archived, which means then prior to that, means we have to be live on a new system. So we, I think, did a really great job at a high level understanding when did we need to be we went to Epic. So that was the EMR we went to. When do we need to be live on Epic? And then how much time does that leave us from that day to the end of our contract, and can we feasibly archive all that data prior to the end of the contract? And I would say the sense of urgency there, I jokingly said if that contract needs to be extended, I probably need to edit my resume before we talk about the contract negotiation just because there was so much time and so much planning put into it that we knew that was something that that shouldn't be acceptable. And so we were able to navigate that pretty easily from the larger contract perspective. I think what I would say to to others, what lessons could be learned from that is you have to really work backwards from when you need to be off a certain system as from a contractual perspective and then all the way back through and how does that impact would you have to be implemented on a new system so that you have enough time to do it? If you have a bigger staff, there's possibilities of doing those things at the same time. You maybe could implement and be doing the archive at the same time. In our organization, that was not an option, so we had to be pretty pragmatic about it. That makes a lot of sense for sure. And with access to certain systems being limited and if you're not able to access some of the databases while you can others, when your team ran into those blocks, how did you adapt with it slowing down the initiative? You were just talking about that timeline over time. Yeah. I think one of the things that everything's got pros and cons and one of the things about oftentimes hosted environments is you may not have the direct access to some of the databases that you would have that was hosted within your four walls. So that was definitely a barrier. I will say the expertise of the team and the things that they were able to do as far as still being able to come up with ways in to extract the data without having that was tremendous for us and really made it made it easier on us in the process. That makes a lot of sense. Sudhakar, from your technical expertise and standpoint, what should people like Brian and their roles keep in mind when it comes to system access or data visibility when these unexpected barriers pop up? Sure. Yeah. Before going into the technical aspect, I'd like to reiterate what Brian said on the nontechnical side. So just to give some more background, what we at Access do is typically we come in when there is a big implementation of EHR happening at the health system. Say, for example, a health system is implementing Epic. The Epic system replaces a bunch of, systems which are already in place. So those systems become legacy. And we archive the legacy data out of the legacy systems and move our cloud based archival solution so that users can still access the legacy data once they are in the new EHR. So that's what we did for Faith Regional Health Services about, a few years ago when they moved Epic. So like Brian was saying, one of the most important things is to take inventory of what legacy systems Epic is replacing. It sounds like a simple task, but many times it is underestimated because these legacy systems have been running and in place for maybe ten years or even longer. Some of them may be still in use. Some of them may be having interfaces in place, data flowing back and forth. So taking inventory is not take taking just names of the systems, but also how it has been used, what interfaces are running, what reports are running, all of it, things like that. The second thing which I would suggest for SCI to is to focus on the subject matter experts, the SMEs. Again, this sounds simple, but legacy systems as by definition, they are old. And when they were installed, there were only certain people who are aware of what modules were turned on, which aspects of the features of the modules were in working condition, where the data is residing, things like that. So taking a inventory of all those means and mapping them to each legacy is something important. Then as Brian was saying, know when these contracts are ending or somehow going into auto renewal. Because you want to sign the archival project in a fashion where you don't end up unnecessarily extending the old contract of a legacy system for one more year. But one final note on this data. One of the things in the a misconception in the industry is who does the data belong to? The data residing in the legacy system. The industry standard is the data belongs to the health care organization or the health system or the hospital. So some legacy vendors may be cooperative, some may not be that cooperative. So it is important to know about the legality around those things like yours act. So the organization should be aware that, the data belongs to them, and they have the right to access the data. And then we come into archiving the data. It is sometimes we don't get access to the database, which makes the task a little bit difficult. But still, we have many tricks in our bags to extract the data and still archive it. So that is another important point to consider because Cures Act is not just applicable to vendors, but also to health systems. Because when a patient is requesting, set of records, which are old, the health systems are required to service that request within a certain number of days. Yeah. That makes a lot of sense. I think as we transition to talk a little bit more about scanned documents and imaging files and challenges that come up with the volume of scanned documents and that are being imaged and with the different systems with much larger collections than anyone expects. Brian, what did your team learn when managing scanned documents and imaging, and what would you want other CIOs or leaders to know early on in their planning with those things that your team saw? Yeah. This probably goes back a little bit to also the assumptions and what do you assume and how how did the project change It's and was enlightening the number of scanned documents that we had that we didn't anticipate. Pretty big endeavor. We had an enterprise document management solution, which we did have a fairly a fairly good idea of what was there. But then other scanned documents within EMRs become a bit of a challenge. And there again, the Access team was able to do a lot of things with with some RPA automation and some distraction to be able to get that data out of those systems. It was clear they had expertise and and knew how to make those things happen, which was great for us because it wasn't always that easy to figure out exactly how to get that data out and what the legacy vendor would or wouldn't do. And the expertise and the experience that the project team brought to the table was really great for us. And, yeah, I would say others should really be thinking about where those scanned documents are, how readable they are, how they want them archived, what's the retention period of them, does that need to change. So So there's a lot of complexity that goes into something that probably a lot of people take for granted. That's a great way to put it for sure. Knowing what you have and where you have it and the retention periods and all of those pieces to the puzzle. Absolutely. Sudhakar, for leaders who may uncover this challenge later in the process of a project, What kind of advice would you share or think of telling them in this situation? Sure. Yeah. First thing is in terms of archival, we not only archive scanned documents and unstructured data, but we can also archive structured data like databases. And the legacy vendors sometimes block Access direct Access to the database, which makes the job a little bit difficult. Or sometimes, you know, put up high price tag on giving a copy of the database. But I think what's important is so when you're encasing a vendor for archival, pick a vendor who has the technology capability to go around and have other tricks to extract the data, not just the database direct copy as the only option. That is important because, like I said, sometimes the direct Access is blocked, and we may still have to extract the data and archive it using other technologies. So at Access, we use RPA. We use reporting. We use various other ways of extracting the data. One more thing is to select a vendor who is flexible in their plan. So for example, if you're archiving, like, 15 systems, if you have a project plan prioritized for the first five and one of them, the legacy system vendor is not cooperating and giving the data, The archival vendor should be flexible enough to change their plans to rearrange the priorities so that they can still proceed with the project with the other legacy systems. And when it comes to large volume of data, it's a real challenge. Sometimes there is a bulk of volume with just because of the size, doing the archival through Internet may be challenging because of just the shared bandwidth limitation of the Internet. So select a vendor who can accommodate moving data even physically if needed. So Access has done physical movement of hard disk securely. And in a way, we are very unique in this industry because Access has, you know, physically warehouses all over the country. So we can send a person to the facility to even move a hard disk or move a server and then take it to a secure location for our cable. Great. So let's transition a bit to looking ahead and the future where as we go into a new year and planning and all of those pieces. Brian, having lived through this project and archiving legacy systems and the whole journey, the challenges that have popped up and have been solved, What do you see coming next or the future in this space, and what would you recommend as guidance for other leaders when they're thinking about doing a project like this, whether or not they should take it on now or wait a while? I think, man, I think I talked a little bit about it. Not waiting, make sure you plan ahead. There's a whole sequence that really needs to be worked backwards in terms of understanding that you can get the process done within the time period that you have been given. I think so it kinda answers the I I waiting, you know, doesn't appear to be an option to me. And I think if you wait, you can run into that resume generating event where you're extending contracts unnecessarily. So I think that's very important. The other part I would say about the project is I had an executive ask me years ago when implementing one of my first EMRs, which was quite a while ago. And they said, when's this project gonna be done? And I think in today's world, we recognize that EMR implementations are essentially never done. There's always enhancements. There's always a new module. In today's world, there's always some new AI type of thing you can do. So I don't believe that's ever done. And I say that because I also don't believe that we've experienced the archiving ever being complete. Since we've implemented, we've consistently had things that we needed to do, other systems that we uncovered, divestitures of things. And as those things happen, you might think that the archival project is a one time thing and it's gonna be over. And I would advise against that. It's just seems to be something that there's always something else and and there's always that again, acquisitions, mergers, those sorts of things. And that that's not even counting things like physical paper records and things that you might need to be able to do with those. I would say, understand, get comfortable, choose a great vendor because you're gonna be with them for a while. And and so it's very important to select right partner. That's great. Yeah. Partnership is key, especially as you talk about these things not being a onetime project as it relates to archival, but also the review of your retention schedules and all the pieces that fit together in a full information management program to be successful and to stay meeting those regulatory requirements and all of those pieces for sure. Brian, before we close out, I wanna congratulate you on receiving the CHIME lifetime achievement award. Sudhakar had told me about that, and it's an incredible recognition. Can you talk a little bit about your leadership mindset and the results that kinda got you there and that journey and how you would advise fellow CIOs who aspire to win the award in the future to work up to getting it. Yeah. I guess, first and foremost, anytime I get a chance to talk about Chime and talk about how impactful that's been on my career and the organizations that I've worked for, I love the opportunity to talk about those things. It's the best way, I believe, for somebody in these roles. And there's also opportunities for lots of other roles within organizations outside of CIOs. And it's expanding. Chime is expanding who they can bring that value to very recently. It's just been a great resource, a great way to network with people, understand who else is going through some of the same things, and I've just been very much thankful for what Chime has been able to give to me. And, again, like I said, to the organizations that I've worked for, from a lifetime perspective, all that really means is that I'm old. And, honestly, it's a fairly lengthy process as far as how long you're a member. And so I've been fortunate enough to have been a member for a very long time and and go through some of the other certifications that Chime has available. And I just think it it brings a lot of value. And, again, I'll keep saying it both to the individual as well as the organization going through some of the certifications and some of the other education that that Chime offers. So I recommend that to anybody and everybody that has the opportunity. That's great. And for those of us in the audience who may not know, so CHIME is the College of Healthcare Information Management executives. And this award that Brian has won, it's really exceptional leadership through health care technology in that space and very well deserved. So congratulations again. That is a big deal, absolutely, especially with projects like the ones we're talking about and working so diligently on those challenges. Brian, Sudhakar, thank you both for sharing your insights with regards to legacy systems archiving. It's not just a technical project. There's a lot of pieces involved there, risk management initiatives, compliance, retention, and very much a leadership initiative as well. So thank you so much. We hope this session helps shine light on those challenges, those unknowns inside your legacy systems, and give you a clear path forward. So thank you again. So welcome back. We did this format slightly different today, and, Sudhakar is with me live to answer questions that you may have. There's a couple that have popped up. So a big thank you, of course, to Brian for joining us from Faith Regional Health Services, and his perspective was greatly valuable. And, hopefully, nobody has to be rewriting their resume right now. So and, you know, feel free to add your questions as we start getting to some of them. So there's a a question that came in about selecting an EHR system. If there's a certain right time, if you will, to think about archival, or Sure. is it something you should handle after the go live time? What are your there? Yeah. I think that's a very good question, and the the short answer is yes. So the the time right time to think about archival is around the same time when you start thinking of changing your EHR. Just to give you some more industry background, if you go back, like, six or seven years, this was not followed. So, typically, what happened in the past was health systems or hospitals, not only selected a new e EHR, they implemented it, they went live with it. And only after a year or two after that, they started thinking about the legacy systems and what to do with the legacy systems. But that has changed over time. Nowadays, people are very proactive and other CIOs are very educated in this area now. So they are starting to think of archival, like Brian was saying earlier in the webinar. They think about it at the time they think of changing the EHR. And, like Brian was saying, it is not just a one time deal, because there are always mergers and acquisition happening. There is expansion of existing EHR, which replaces additional legacy systems. So you always have a continuous archival process in place. So, yeah, so start planning as soon as possible, and it is going to save you time and money down the line. Yeah. No. That makes that makes a lot of sense. And, you know, when you're you're thinking about all those things, I'm curious about, would you just archive electronic medical records? I know that with decommissioning, with legacy systems, there's a whole bunch of need there. But what do you think about that? Yeah. So electronic, medical records or EHR is pretty straightforward because there is data retention requirement. Typically, it varies state to state and, on an average, it's about ten years at a minimum for data retention. You don't want to pay legacy systems contract for another ten years when you are not using them. So that is the main motivation to archive those into one centralized system. But beyond the EHR, patient data is available in various other systems. So I see some of today's participants are from, insurance companies, payers, city government. All of those also have some, patient or, personal information which needs archival. And we have done archival of those as well. We have done archival of payer data. We have archived Citi's data, which is related to human resources payroll. Like, you know, you know, IRS also requires retention of seven years of data. And so and we have the capability to archive even ERP kind of data, which is, you know, PeopleSoft, Oracle, so so ServiceNow applications like that. So we can archive any type of data in our system. That's great. Yeah. And if there's any questions about what we can and can't do, of course, reach out at any time. There is a question here, and I I love this one because I feel like so many of us feel the same way. We already have an archival vendor, and it's generally working, but there's pain points. Right? What should we be looking at? I I feel like it's with almost anything, it's it's working kind of, sort of. It's good enough or, you know, that saying it's fine. Everything's fine. But, is it really? What should you be evaluating? Yeah. So sometimes, you end up with selecting an archival vendor when the health system was small or you had only one small legacy system to archive. So you might have made a wrong choice in making a selection of archival vendor, but just because you selected them, you kind of try to run with them for larger systems, and that may not work in the long run. So as you your organization grows or you have more legacy systems to archive, you may really need a vendor who can manage that kind of, project value. And, the and it is never too late to reevaluate your past decision and look at, you know, floating new RFPs or selection process for a new archival vendor. Not only that, we do have customers, large health systems, which consciously have selected more than one archival vendor, and they retain them on an ongoing basis, because they know that different vendors have different strengths. So they use, one vendor for certain types of archival and another vendor for another type of archival. So we have seen that also trending in the industry nowadays. Yeah. No. That that makes a lot a lot of sense. There is a a question about retention requirements. I feel like that's a topic we are constantly discussing in one way, shape, or form here at Access and on our webinars and with the data that would go into an EHR. So are the retention requirements for payer data similar to the Yeah. It is very similar, but it is a little bit more complicated because usually data? what happens in the EHR situation, the customer is located in a certain geography, a particular state, and they deal typically with patients in that state predominantly. So the rules are pretty straightforward. But when it comes to payer, you, as a payer, may be servicing customers from multiple states. So your database may contain data from, you know, different states, and each states have some changes in regulation. We at Access can help sort that out, and, we can work with your governance data governance team and, come up with the, the retention period requirement for all your data. And, we also have a feature for purging old data as we go along, you know, both for the physical data, the paper records, as well as for the digital data, we have purge option. So we can not only archive everything which you need, but we can also keep up and post the unwanted data so that your liability and the cost is reduced over the lifetime. That makes sense. I did, just for the audience here, open up a poll. So on that right hand side, you'll see the next to the chat poll. So please feel free to to toggle over there and let us know what stage if this applies to you, of course, what stage is your organization currently in regarding changing or upgrading their EHR systems? And, of course, as Sudhakar mentioned, not all of you, of course, are in the exact space or a hospital system or something like that. But, I guess for those that are currently in that realm, I'm curious, you know, where you are at. So someone is saying no change. There's, someone is transitioning right now, and the legacy systems archival is completed. And a lot of people aren't sure, which I don't think it's a bad thing to not be sure. Sudhakar, what do you think there? Yeah. I think, it, in a very large audio on a medium sized health system, it is very difficult to get the full picture of what is going on across the, you know, length and breadth of the various hospitals and clinics. There may be, not only changes being implemented, there may be acquisitions happening, which means when you acquire a hospital or a clinic, you typically ask them to change over to the centralized EHR, which will be a new EHR for them. So, therefore, what they were using previously becomes a legacy system. So this will also trigger a data archival requirement in those situations. So, so I'm not surprised that, you know, having a centralized view is not there, but we can help with that as well. So access can, do a scoping project for your health system or your organization, understand your various systems which are in place, which are legacy, what is the retention requirement for each and all of them, and put a scoping project in place for you as well. That's great. I do have one more poll for the audience if you guys are are open to it, asking if your organization is partnered with a vendor for legacy data archival. You know, it's something that comes up all the time of who do we partner with. Do we have more than one partner for different things and systems that we have in place. It is, you know, to Lisa's point in the chat, transitioning multiple EHRs to one and actively archiving, that is a multiyear. That's a big project for sure. So thinking of you and wishing you luck, Lisa. But let me share this current poll that I just opened here so we can take a look at what everybody in the audience is saying. There are a lot of people who have already partnered, for votes there and then a few that are not planning to archive just yet. So I'm curious. You know? Right? There's the ones that say no plans to archive, but they have legacy systems. Yeah. That's right. That was, yeah. I want to comment on that. You got that very rightly, Jamie. So, basically, this works if you are a small clinic or a small hospital, like a stand alone, and you have only one legacy system, then, yeah, many times the legacy system vendor may say, okay. I'm going to reduce your license fee, give you a read only access that works fine for a short time. But then the moment you have a larger place where you have an EHR replacing three legacy systems or two legacy systems, then you have multiple legacy systems which are in read only mode. You will be very surprised what happens after one year of not logging into our old system. People forget the password. They don't know how to access, and, you know, people change jobs. You may not even have the people, who knew the whole system. They may not know where to run a report to download the patient chart. Think it very complicated very quickly. So, yeah, this this is a short term solution. Yes. But in the long term, you may want to consider a centralized archive, which archives multiple legacy systems into one database and, also, can be an ongoing archive for your future changes in organizations. Oh, yeah. And then, you know, there's all sorts of bad actors out there that are hungry for data that's sitting there just waiting for for them to get it. So definitely, you know, transitioning and getting that data into a safer space versus sitting in an abyss is probably a a good idea. Yeah. Absolutely. I forward that point. That's a very important point. Sometimes you may even end the support of the legacy system thinking that it is just a server sitting in our basement. What can possibly go around? Right? So and you'll be surprised it may be running on a Windows Server, and the Windows Microsoft may sub start stop supporting so security patches on those Windows Server operating system. Then automatically, the software running on top of it becomes vulnerable for all kinds of attacks. Yeah. Data protection is key all around for sure. So thank you all today for joining us for this great webinar and conversation. Special thank you to Brian from Faith Regional Health Services for, you know, lending us your expertise. Definitely join us especially if you're a team of one in your information governance and rim programs. We have a webinar on the twenty eighth, flying solo, something that sometimes you gotta do, but how do you make the best of it? And definitely stay tuned and on the lookout for more webinars, and I'm sure Sudhakar is gonna be joining me for others in the near future as well. So thank you, Sudhakar, for your expertise and insights here and, of course, our audience for engaging with us in the polls and questions. So we always appreciate you for that. Until next time, take care, everybody.