Shutting Down a Legacy EHR Under an Active Legal Hold

What governs the decision

• Retention minimums come from state law and the organization's approved retention schedule, not from the vendor's shutdown date. Ten years post-encounter for adults and majority-plus-7 for minors means a large share of the 640,000 patients are still inside their retention window; those records cannot be destroyed on the CIO's timeline.
• Legal hold supersedes the schedule. The 2019 and 2021 surgical cases put every related record, audit log, and metadata element under a hold that runs until counsel releases it in writing. Nothing in that scope may be purged, altered, or rendered unreadable.
• Disposition is a formal act. Destruction requires documented authorization, a certificate of destruction, and evidence the hold was cleared. A system decommission is not a disposition trigger.

What must not happen

1. Destruction of records still inside retention.
2. Any action affecting held records, including loss of audit-log readability.
3. A unilateral IT decision without HIM, legal, compliance, and privacy sign-off recorded in the IG minutes.

Board deliverable: a scope map showing which records are past retention, which are in-window, and which are held, with the disposition method for each.

Cost math first

• Export: 4.1M pages x $0.09 = $369,000 one-time, plus storage and ongoing retrieval labor.
• Viewer: $95,000/year, roughly $950,000 undiscounted across a 10-year retention tail.

Cost alone is misleading. Evaluate against these criteria:

Criterion	PDF bulk export	Archive viewer
Audit trail and metadata preserved	Usually lost	Retained
Discrete data queryable for ROI, quality, or litigation	No	Yes
Readability over 10+ years	Depends on PDF/A conformance and index	Vendor-dependent, needs exit clause
Response time to record requests and subpoenas	Manual page hunting	Structured retrieval
Cost predictability	One-time plus labor	Recurring, escalating

Recommendation logic: a blanket export fails the metadata and queryability criteria, which are exactly the criteria litigation and record requests stress. A defensible answer is a hybrid: keep the viewer (or a negotiated data-extract-plus-index arrangement) for records still in retention and for the held cases, and bulk-export to PDF/A only the closed records that are past retention and about to be destroyed. Require the vendor contract to include a data-extraction clause on exit, and require HIM to validate a random sample of 100 records in whatever format is chosen before any source system is retired.

Route the decision through the information governance committee, not through IT alone.

• Membership for this item: HIM director (chair), CIO, general counsel or risk management, privacy officer, compliance, clinical informatics, and a revenue-cycle representative because billing records are in scope.
• Inputs: the retention schedule, the state statute citation, the litigation hold notice, a data inventory of the legacy system, and a risk assessment covering loss of audit trail and unreadable formats.
• Decision record: scope (which record types and date ranges), chosen disposition method, exceptions for held records, validation results, owner, and review date. File it as the formal disposition authorization.
• Escalation: the board or its audit/compliance committee approves the disposition of records still in retention only if legal advises it; otherwise the IG committee has authority and the board receives the summary.

Test of a good answer: the decision traces to a statute or schedule, names a hold release, names an accountable owner, and would survive a plaintiff attorney asking in a deposition why the system was retired and what happened to the audit trail.