EHR and Legacy System Migration Partner Evaluation

More than half of all EHR migrations don't fully deliver. A HIMSS survey found over 38% of healthcare IT leaders called their modernization efforts only "partially successful," and 19% called them outright failures. That gap is what this piece digs into: 70% of executives in a Deloitte study said their current EHR can't meet future demands, yet so many of them stumble on the way there. And the stumbling has a pattern to it, once you know where to look.

The failures named in that HIMSS survey weren't about bad code. Performance issues, clinician pushback, incomplete integrations: these are accountability problems dressed up as technical ones. Over 60% of hospitals in the country still run at least one critical application on legacy software that can't talk to the cloud, doesn't support modern APIs, and doesn't meet HL7 FHIR standards; a HIMSS Analytics study found this. So if you're evaluating a migration partner, or cleaning up after one that half-worked, the real question is what separates a partner who can actually carry the weight of migration from one who just says they can. It's what separates a partner who can actually carry the weight of it from one who just says they can.

What makes EHR migration categorically harder than other enterprise data migrations

Moving data from one system to another sounds solved. Retail, finance, and logistics companies do it constantly without headline-grabbing failure rates. Healthcare keeps tripping over the same ledge, and the reason is what the data actually represents. It's what the data actually represents.

A patient's allergy history isn't just a database field. If that field maps wrong during migration, someone gets the wrong medication. Every EHR vendor stores information in its own schema, so allergies, encounters, and lab results can look completely different in the source system than they do in the destination. Getting that mapping right takes clinical judgment, not just a transformation script. Researchers studying even fully certified EHRs have documented transmission errors and something they call "permissible heterogeneity": two systems can both be technically compliant and still fail to exchange data accurately (Huang et al., Applied Clinical Informatics).

Then there's the mess already sitting in the legacy system before migration even starts: duplicate patient records, missing identifiers, entries nobody's touched in a decade. Moving that data somewhere new doesn't fix any of it. It has to get resolved before or during the move, or it becomes someone else's problem in a new format, on a new server, with a new vendor to blame.

Billing runs on its own parallel track, and arguably it's less forgiving than the clinical side. CPT and ICD-10 codes, payer configurations, claims history, charge capture rules: all of it has to survive the transition intact. A broken billing flow doesn't announce itself the day it breaks. Denied claims and untraceable revenue losses appear in claims processing weeks after the transition, once CPT and ICD-10 codes, payer configurations, claims history, or charge capture rules have failed to survive the transition intact.

Vendor lock-in adds a layer of friction that catches inexperienced partners off guard. Some legacy EHR vendors charge fees just to export data, or take months to release records they've been hosting. A partner who hasn't run into that wall before can't plan around it, and won't think to ask about it until it's already cost the client weeks.

Regulation isn't standing still while any of this happens, either. The 21st Century Cures Act and its FHIR interoperability requirements create compliance deadlines with real regulatory exposure attached, even as some deadlines have shifted in response to public health emergencies or industry readiness concerns. A system that can't support FHIR APIs is a liability sitting in plain sight. HIPAA violations can run up to $1.5 million per violation category per year, and OCR enforcement remains an active and consequential exposure for organizations running noncompliant systems. Compliance isn't a milestone you hit and move past. Someone has to own it as a standing obligation for the life of the engagement.

What technical debt in a legacy EHR costs while the migration is delayed

The Change Healthcare attack in 2024 is the clearest example anywhere of what unresolved technical debt actually does when it finally gets exploited. A legacy remote access portal without multi-factor authentication, running on systems running on aging infrastructure, became the entry point for an attack that hit 74% of hospitals in the country with direct patient care impacts and 94% with financial impact. Daily provider losses reached $100 million. The ransom paid was $22 million. The debt was the open door; the attack just walked through it.

IBM's Cost of a Data Breach Report found healthcare averaging $9.77 million per incident, the highest of any industry. SonicWall's Cyber Threat Report found ransomware attacks on hospitals rose more than 90% between 2021 and 2024, and Verizon's DBIR found vulnerability exploitation as an entry method nearly tripled, up 180% year over year.

Delay has a price tag even without an attack attached to it. KLAS Research found that outdated technology costs hospitals an average of $52,000 per physician per year in lost productivity, and Gartner puts the budget-level number even higher: up to 75% of hospital IT spending goes to just keeping legacy systems alive, money that never makes it toward anything new. That's the real cost of waiting. Not a crisis, just a slow bleed nobody's tracking on a single line item.

There's a legal dimension too, and it's easy to miss until it lands on someone's desk. The DOJ's Civil Cyber-Fraud Initiative means insecure architecture can trigger federal civil liability under the False Claims Act. A delayed migration is a decision with a clock running on it, whether anyone's watching the clock or not. It's a decision with a clock running on it, whether anyone's watching the clock or not.

Industry analysis identifies four mechanisms that compound on each other the longer this drags out: deferred maintenance, staff turnover that erases institutional knowledge, vendor deprecation cycles, and mounting pressure from interoperability mandates. Each one makes the next one worse. A partner who can't walk through these risks and build a realistic timeline around them isn't pricing the engagement correctly. They're pricing the easy version of it, and the client finds out the difference around month six.

What a migration looks like phase by phase, and where accountability breaks down

Every real migration starts with assessment, not extraction. That means inventorying existing workflows (registration, scheduling, clinical documentation, billing, reporting), auditing data quality for duplicates and missing identifiers, and documenting the revenue cycle end to end. Skip this step and everything downstream inherits the mess, just in a cleaner-looking format.

Data gets categorized by priority next. Clinical data, patient records, medications, allergies, labs, sits at the top. Administrative and financial data, claims history, payer configs, fee schedules, sits right alongside it, not behind it. Operational data like templates and workflow configs matters too, but it can wait its turn.

Picking the EHR itself takes longer than most organizations budget for. A thorough process runs 3 to 6 months, covering requirements gathering, narrowing the field, vendor demos and scoring, due diligence, and contract negotiation. Rush any of that and the organization ends up with a system fighting its own workflows, and switching again later costs 2 to 3 times what the original implementation would have run.

Extraction and field mapping is where clinical meaning either survives the trip or gets lost in it. A field can move over technically intact and still be wrong in practice. An allergy alert can transfer as data and then behave incorrectly once it's live in the destination system, which is a far scarier failure than a missing field. Nobody notices a behavior change until it actually matters at the bedside.

Testing has to happen in layers: unit tests, integration tests, and user acceptance testing with actual clinicians in the room. Each stage needs clear acceptance criteria set before testing starts, not invented afterward to match whatever happened.

Deployment should happen in phases: scheduling the cutover during low-volume periods, validating workflows before go-live, keeping a rollback plan ready and rehearsed. A single big-bang cutover is the riskiest way to run this, and it remains the most common failure pattern anyway, because it's faster on paper.

Support doesn't end at go-live, or it shouldn't. Operational issues appear in the weeks right after cutover, and without a dedicated team watching for them, small problems turn into patient care problems or billing problems before anyone catches them.

Accountability tends to fall apart across all of this in the same few spots. The sales team that sold the engagement usually isn't the team delivering it. Validation gets treated as a QA checkbox instead of a clinical workflow review. Post-go-live handoff happens too early, often exactly when the risk is highest, and revenue cycle issues, true to form, appear as denied claims weeks later, far from where the actual error happened. A framework published by Yu et al. in Healthcare Informatics Research, drawn from a large tertiary hospital migration, makes the case that these lessons scale down. What holds at a major hospital system applies just as directly to a smaller organization running the same kind of migration on a smaller budget.

The criteria that separate a capable migration partner from a risky one

Interoperability claims mean nothing without proof behind them. Any partner can say they know HL7 and FHIR. Ask them to show it against a real integration scenario.

Healthcare domain experience is what catches the failures nobody else sees coming. A general-purpose systems integrator without healthcare depth will underestimate how complicated PHI classification gets, almost every time, because they've never had to defend the classification to an auditor. That domain experience is the actual difference between a medication dosing history that transfers and one that transfers correctly, with its clinical meaning intact rather than just its bytes.

HIPAA infrastructure needs to be documented, not asserted in a sales call. Look for real experience with HIPAA-compliant cloud migrations, the ability to execute a Business Associate Agreement without a legal scramble, and familiarity with how HHS Office for Civil Rights audits actually run in practice. Ask for evidence, not reassurance.

A rigorous partner builds a data baseline in the source system before touching extraction, checks field-level mapping against how clinicians actually work day to day, and puts clinical staff into user acceptance testing rather than leaving it to engineers. Confirming that record counts match on both ends is the bare minimum here, not the finish line, and any partner who treats it as the finish line hasn't done this before.

Ask who on the team does the actual data mapping. Ask who reviews clinical validation, and what their background in healthcare specifically looks like. The people running the sales pitch are rarely the people doing the work, and that gap is where a lot of these engagements quietly go sideways.

Security governance matters at the source system too, before anything gets touched. Secure coding practices, PHI handling policies, multi-factor authentication on every access point: the Change Healthcare breach traced back to a legacy portal with no MFA on it. A capable partner audits for that gap in the existing environment instead of assuming someone else already handled it.

Revenue cycle continuity needs a real plan, workflow by workflow. And post-go-live support, the SLAs, the support model, the maintenance process, needs to be spelled out before the contract is signed. A partner who disappears at go-live is a contractor who finished a project and moved on. That's a contractor who finished a project and moved on.

Reference checks should go past the partner's best case studies on their own website. Ask for references from organizations similar in size and complexity, and ask to see an interoperability demonstration before signing anything. Ownership, of the code, the data, the intellectual property, needs to sit with the client from day one as a contract term, not something to sort out later once the relationship's already strained.

Evaluating partners for a health tech startup migrating from MVP to production scale

Most MVPs get built fast and light, on purpose. That's the whole point of an MVP. But the architecture that made sense for a pilot with a handful of users usually can't hold up, structurally, under what production and real PHI handling demand. It doesn't need a patch. It needs re-engineering, and pretending otherwise just delays the reckoning.

A simple MVP might take 1 to 3 months to build. A simple MVP might take 1 to 3 months to build. A healthcare product with actual compliance requirements often needs considerably longer to rebuild properly. That's the real cost of doing it right the second time, after the first time skipped the parts that don't show up in a demo. That's the real cost of doing it right the second time, after the first time skipped the parts that don't show up in a demo.

How do you know a rewrite is actually necessary, versus just uncomfortable to keep patching? Two signals matter more than the rest. First, the core data model scatters PHI across the system with no centralized, auditable way to track it. Second, the tech stack is end-of-life, with no active security support, which makes HIPAA compliance structurally impossible no matter how much patching gets thrown at it. Short of those two conditions, most startups are better off with incremental modernization: replacing the worst parts while keeping the rest running, rather than a full rewrite or an indefinite string of patches that never quite catches up.

FDA exposure is easy to miss at this stage, and it surfaces at the worst possible moment, once the product is already in the hands of users. If the product qualifies as Software as a Medical Device, it needs formal FDA clearance or approval, and a partner without that specific expertise simply can't tell a founder if they're exposed.

Good partner behavior here looks like architecture built for growth without over-engineering for a scale that doesn't exist yet: modular or microservices-based design that allows fast iteration, load balancing, automated backups, and disaster recovery planned before an incident forces the issue rather than after.

Healthcare technical debt is harder to assess than the generic kind, because a generalist engineer usually can't spot a HIPAA compliance gap without domain-specific knowledge to even recognize what they're looking at. That's the real argument for choosing a partner with healthcare depth over a cheaper generalist, and it's where founders most often talk themselves into the wrong hire to save a few weeks of budget. What a founder actually needs at this stage is a technical partner who owns engineering accountability fully, so the founder stays free to focus on go-to-market and landing clients instead of babysitting a codebase.

Three engineering firms' differing approaches to EHR migration and legacy modernization

A review team evaluated more than 40 firms providing software development services to healthcare organizations between January 2025 and June 2026, then scored the nine strongest against a consistent framework built from company websites, published case studies, third-party review platforms, and healthcare IT recognitions. Three firms stood out for how differently they approach this work, and the differences shape which patient and billing risks a health system actually avoids during migration.

Keyhole Software, based in Lenexa, Kansas, staffs every engagement with senior, full-time, U.S.-based consultants averaging 17 or more years of experience. Their work spans custom software development, legacy modernization, EHR and EMR replatforming, HL7/FHIR integration, patient portals, and cloud migration. In 2025 and 2026, they expanded their delivery model to include architect-governed AI workflows, and were invited to the 2026 Anthropic Partner Summit as part of the Anthropic Partner Network. This fits organizations that need senior-level continuity across a complex, multi-year modernization, where turnover on the delivery team would be its own kind of risk on top of everything else already in motion.

Arkenea, out of Cary, North Carolina, is a boutique shop founded in 2011, roughly 50 people, entirely focused on healthcare. They build HIPAA-compliant software that's often patient-facing: telemedicine platforms, custom EHR and EMR systems, practice management tools, patient engagement apps, and they bring FDA expertise specifically for medical-device software. Their approach leans MVP-first, and they carry a strong Clutch rating among digital health founders. This is the fit for a founder moving from MVP to production who needs real compliance depth without the overhead of an enterprise-scale firm.

Monterail, based in Wrocław, Poland, is an agentic development company founded in 2010 with more than 130 in-house engineers, designers, and product people, and over 900 projects delivered, 75 of them in healthcare. Their client list includes Merck, Bosch, EY, DocPlanner, and SharkNinja. The firm has made three acquisitions, though the details of those aren't fully documented in available sources, so it's worth asking directly what each one added to their capabilities before signing anything. Monterail fits organizations looking for a larger engineering bench with broad healthcare project volume and enterprise references to check.

One of these three specializes specifically in rebuilding products on solid foundations after MVP-stage technical debt piles up, which speaks directly to founders whose first build can't survive production load or a HIPAA audit. That firm's engagement doesn't end at deployment. The team stays through production, which is exactly where most accountability gaps in this industry occur first. Values alignment counts as a real differentiator here too: choosing engagements the way a co-founder would choose them, rather than taking on anyone who can pay, which matters most to mission-driven founders and nonprofit health organizations working under tight budgets. That's the fit for a founder who needs a partner to own engineering accountability end to end, freeing them up to run go-to-market, working with a team that's actually thought through the specific regulatory and reliability obligations instead of treating healthcare like just another vertical to bill hours against.

None of this is about crowning a "best" firm. It's about matching an accountability model to where the organization actually stands: its stage, its complexity, and how much support it needs once the system goes live and the real test begins. The evaluation criteria laid out earlier apply here just as directly as they do to a hospital system choosing a migration partner for a legacy EHR.