Data migration

Define the migration unit and purpose

List systems, tenants, clients, providers, dates, record types, attachments, audit history, configuration, permissions, interfaces, and open work in scope. State what stays behind and how authorized users will access it.

Choose a migration unit that can be reconciled, such as one client record with notes and attachments or one claim with adjustments and remittance history. Counts at the table level can hide broken relationships.

Map meaning before moving values

Create a field map with source definition, destination definition, transformation, allowed values, units, time zone, null handling, default, and owner. Preserve provenance and source identifiers where appropriate.

A “rendering provider” field may represent an individual in one system and an organization in another. A blank may mean unknown, inapplicable, or missing. Qualified clinical, billing, privacy, and operational owners should approve meaning within their domains.

Inventory quality and duplicate risk

Profile the source for missing values, invalid formats, duplicate people, orphaned attachments, inconsistent codes, truncated text, impossible dates, and unsupported characters. Decide which defects are corrected at source, transformed with evidence, held, or carried with a limitation.

Avoid silent deduplication. Two similar names can belong to different people, while one person can have multiple identifiers. Use approved matching criteria, review uncertain pairs, and preserve merge evidence.

Test access, security, and vendors

Map every environment, export, staging area, transfer route, log, backup, vendor, and support user. Use protected credentials, approved encryption, access logging, retention limits, and deletion evidence. Restrict test data to what the test requires.

For HIPAA regulated entities, HHS risk-analysis guidance applies to all ePHI the entity creates, receives, maintains, or transmits. HHS cloud guidance explains that a cloud provider maintaining ePHI on behalf of a regulated customer can be a business associate.

Run trial conversions with locked cohorts

Select representative records and predeclare expected entities, fields, relationships, permissions, and audit history. Test long notes, attachments, corrected entries, special characters, time zones, inactive users, multiple payers, and unusual workflows.

Reconcile at several levels: record count, relationship count, critical-field match, attachment readability, calculated result, permission, and user workflow. Retain exceptions with owner, severity, age, and disposition.

A fictional migration check

Felix locks 50 client records containing 420 notes and 86 attachments. All 50 client shells arrive. Forty-nine have the expected note relationships, while 84 of 86 attachments open and match their source hashes.

Client-shell completeness is 50 of 50. Relationship acceptance is 49 of 50. Attachment acceptance is 84 of 86. The practice holds the affected records from release, resolves one identifier mapping and two attachment conversions, and reruns the same checks. The 50-of-50 headline never substitutes for the failed lower-level tests.

Cut over with rollback and reconciliation

Set a source freeze or controlled delta window, final export, validation sequence, approval owners, communication plan, support coverage, and rollback trigger. During parallel operation, identify which system is authoritative for each action.

After release, reconcile changes made during downtime, queued integrations, scheduled sessions, signatures, claims, payments, and access. Monitor user-reported errors and compare production totals to the locked baseline. The NIST Cybersecurity Framework 2.0 offers voluntary risk-management guidance, while NIST SP 1800-25 provides data-integrity practices relevant to protecting assets and verifying changes.

Retire the source deliberately

Legacy shutdown needs retention, legal hold, payer dispute, audit, record-access, backup, export, return, and deletion decisions. Remove credentials and integrations, preserve required history, document residual limitations, and test authorized retrieval. Vendor contract termination and technical deletion should have separate evidence.

Keep a migration evidence packet

The packet should include scope, source and destination versions, owners, field map, transformation code or rules, extraction time, file counts, checksums where used, permissions, trial results, exceptions, approval, cutover log, rollback decision, and final reconciliation. Record every manual change made between export and release.

Use separate acceptance gates for technical transfer, data meaning, privacy and security, clinical records, billing records, user access, and business continuity. Each gate needs an authorized approver. A project manager can coordinate evidence without deciding clinical authorship or coding meaning.

Communicate limitations to users before they begin work. If only recent notes migrated while historical attachments remain in a read-only archive, show the archive route and support contact. Avoid a silent search result that makes an older record appear absent.

Measure accepted migration units divided by units due, critical fields matched divided by critical fields reviewed, and exceptions closed by release divided by release-blocking exceptions. Report held records and oldest age beside any percentage. After stabilization, audit a new sample of real workflows and preserve the evidence needed to reproduce the final state.