Designing a Data Lifecycle and Retention Policy for Legacy Imaging
A hospital is migrating 15 years of imaging studies to a cloud archive. The on-premise PACS holds 2.4 petabytes; roughly 60% of studies are older than seven years. State retention law requires adult medical records be kept 10 years after last encounter and minors' records until age 28. The cloud vendor offers tiered storage: hot, cool, and archive. Query latency for archive tier is up to 12 hours. Radiology wants fast access to prior studies for comparison; compliance wants defensible retention and legal-hold capability; finance wants to cut storage cost. Some studies belong to patients with open litigation holds.
1. How would you design the storage tiering and retention policy to balance these demands?
Read the worked answer
Tier by access likelihood and legal status, not by age alone, and make retention rules defensible and auditable.
- Classify each study by last-encounter recency, patient age/minor status, and legal-hold flag. Retention clock runs from last encounter, so age of study is a proxy, not the rule.
- Hot tier: studies within the clinically relevant comparison window (e.g., last 2–3 years) and any study flagged for active care or legal hold.
- Cool tier: older studies for active patients still within retention.
- Archive tier: studies past retention or for patients with no recent encounters, accepting 12-hour latency.
- Legal holds override everything: hold-flagged studies stay retrievable and are excluded from any deletion, with an audit trail.
- Retention engine: automated rules compute eligibility from last encounter and minor status; deletion requires dual approval and logging.
- Retrieval SLA: document that archive-tier latency is acceptable for non-urgent comparison; provide a fast-retrieve path for urgent cases.
This gives radiology speed where it matters, compliance a defensible rule set, and finance the savings from moving the bulk to archive.
2. Two years later, a subpoena arrives for a patient whose studies were scheduled for deletion. What lifecycle controls should have prevented a problem?
Read the worked answer
The risk is destruction of records under a legal hold or within retention. Controls that should exist:
- Legal-hold integration: a hold placed by legal must propagate to the retention engine and suspend deletion for that patient. The subpoena should trigger a hold that the system honors automatically.
- Retention verification before deletion: confirm last-encounter date and minor status from the source of record, not from the imaging metadata alone, which may be incomplete.
- Deletion audit trail: every scheduled and executed deletion logged with rule, approver, and timestamp, so the organization can demonstrate what was destroyed and why.
- Pre-deletion review window: a hold period between 'eligible' and 'deleted' during which legal can intervene.
- Chain of custody: archive-tier objects retain integrity checks and provenance so retrieved records are admissible.
If deletion already occurred, the defensible position depends on whether the record was past lawful retention and whether a hold existed at the time. Document the policy, the rule applied, and the audit trail; that record is what protects the organization.