Migrate hospital data with reconciliation and rollback
For CIO/CTO / digital programme owner · Plan implementation
TL;DR — what you’ll learn
- Treat hospital data migration as an audited clinical and financial record handover—never switch off the legacy system on row-count equality alone.
- Reconcile patient master identities, allergy/alert flags, active inpatient orders, open AR/deposit balances and linked diagnostic PDFs by explicit cohort.
- Hold duplicate UHID merge candidates, unmapped allergy codes and broken attachment links in a domain-reviewed exception queue before cutover.
- Rehearse a timed rollback and maintain verified read-only legacy access until post-cutover clinical, MRD and finance sign-off is complete.
Illustrative hospital administrative and operations coordination desk; not a client facility.
Ahead of a planned HIS replacement cutover (MIG-CUT-2026-11), a hospital runs a dry-run migration of 5,000 active and recent patient cohorts from its legacy database into the target platform: 4,760 cohorts reconcile 100% across demographic identity, clinical summaries, diagnostic PDF attachments and open billing/deposit ledgers; 110 legacy patient records are flagged as probable duplicate UHIDs (DUP-MIG-01..110) where automated merging by mobile number would risk combining two family members’ charts; 75 clinical allergy and alert entries contain legacy free-text strings that failed target terminology mapping and defaulted to blank in the test load; and 55 historical discharge-summary PDFs failed checksum/link validation after storage bucket migration. If the project team declares the dry run "95.2% successful" and proceeds to weekend cutover, 75 patients lose visible allergy banners and 110 family charts risk silent corruption.
For hospital CIOs, migration leads, medical-records heads, finance controllers and clinical informatics officers, the core question is what reconciliation evidence and rollback readiness a provider must require before switching to migrated records.
Separate data movement from clinical correctness
Moving bytes between database tables is not the same as preserving clinical and financial record integrity. A safe hospital migration defines a clear *scope boundary*—what active and recent historical horizon is migrated into live transactional tables (for example, active inpatients, open financial balances, active packages, master patient index, verified allergies and recent clinical encounters) versus what older history is preserved in asearchable, immutable read-only clinical archive linked by UHID.
The Bahmni registration documentation, NRCeS ABDM FHIR Implementation Guide (v6.5.0) and Bahmni billing and accounting provide technical reference examples for patient identity separation, structured clinical/FHIR profiles and billing/accounting boundaries (context only; migration scope, clinical allergy/medication mapping, financial cutover balances and record-retention duties must be approved by the hospital’s clinical governance lead, MRD head, finance controller and privacy counsel).
In the synthetic 5,000-cohort MIG-CUT-2026-11 dress-rehearsal reconciliation, migrated records are validated across identity, clinical safety fields, attachments and financial control totals:
Scroll horizontally to see all columns.
Migration dress-rehearsal cohort (MIG-CUT-2026-11) | Patient cohorts | Source-to-target validation check | Identified migration exception | Pre-cutover governance decision |
|---|---|---|---|---|
| Fully reconciled cohorts (identity, clinical & finance) | 4,760 | Hash, control totals & sample clinician check passed | None | Cleared for production cutover load |
Probable duplicate UHIDs (DUP-MIG-01..110) | 110 | Shared mobile/address across family members | Auto-merge blocked to prevent chart collision | Retained as distinct IDs; routed to MRD merge-review queue |
| Unmapped free-text allergy/alert strings | 75 | Legacy text failed target coded dictionary | Target allergy banner rendered blank on first test | Cutover blocker; mapped/preserved as visible alert before go-live |
| Broken discharge/lab PDF attachment links | 55 | Object path/checksum mismatch in target DMS | Clicking historical report returned file-not-found | Object paths repaired & 100% checksum-verified |
| Total dress-rehearsal sample (`MIG-CUT-2026-11`) | 5,000 | 4,760 clean + 240 domain exceptions caught | Zero silent drops or auto-merges permitted | Cutover gated until all 240 exceptions are remediated & signed |
All 5,000 dress-rehearsal cohorts (4,760 + 110 + 75 + 55 = 5,000) are accounted for: the 75 unmapped allergy strings and 55 broken PDF links (130 technical defects) are fixed and re-tested before cutover, while the 110 shared-phone UHID records are protected from automated merging until MRD verifies identity.
Compare full cutover and staged history
Never allow an ETL script to auto-merge patient identities based on phone number or name similarity during migration (DUP-MIG-01..110), and never silently drop unmapped clinical fields. If a legacy allergy, implant note or high-risk alert cannot map cleanly to a coded target dropdown, the migration contract must surface it prominently in a structured "Unmapped Legacy Clinical Alert — Verify at Encounter" banner rather than leaving the target field empty.
Connect data-migration acceptance with Resolve duplicate registrations without merging the wrong people, Connect hospital billing and the general ledger without double posting, Create a records-retention schedule by record type and legal basis and Rehearse hospital downtime and the return to digital records so duplicate UHID governance, HIS-to-accounting control totals, statutory record retention and cutover downtime procedures follow one reconciled plan.
Worked workflow
Original illustrative workflow. Follow the labelled transitions, including the exception paths.
- A · StepFreeze migration scope, field mapping rules, financial control totals and rollback timing window
- B · StepExecute dry-run extract/load and run automated row-count, financial-balance, attachment-hash and field checks
- C · StepConduct domain-owner sampling (clinicians, MRD, pharmacy, finance) and inspect all unmapped/duplicate queues
- D · DecisionZero unmapped safety fields, 100% financial/attachment reconciliation and domain sign-offs complete?
- E · StepBlock production cutover (or trigger rollback) and isolate allergy mapping, attachment or balance defects
- F · StepRecord corrected ETL mapping, repaired document links and MRD-approved handling of duplicate UHID candidates
- G · StepClinical, MRD, finance and IT leads sign off production cutover and verify live post-load control totals
- H · StepMaintain verified read-only legacy archive access and monitor post-cutover reconciliation queue
Scroll horizontally to see all columns.
| From | Condition | Next |
|---|---|---|
| A: Freeze migration scope, field mapping rules, financial control totals and rollback timing window | Continue | B: Execute dry-run extract/load and run automated row-count, financial-balance, attachment-hash and field checks |
| B: Execute dry-run extract/load and run automated row-count, financial-balance, attachment-hash and field checks | Continue | C: Conduct domain-owner sampling (clinicians, MRD, pharmacy, finance) and inspect all unmapped/duplicate queues |
| C: Conduct domain-owner sampling (clinicians, MRD, pharmacy, finance) and inspect all unmapped/duplicate queues | Continue | D: Zero unmapped safety fields, 100% financial/attachment reconciliation and domain sign-offs complete? |
| D: Zero unmapped safety fields, 100% financial/attachment reconciliation and domain sign-offs complete? | No | E: Block production cutover (or trigger rollback) and isolate allergy mapping, attachment or balance defects |
| E: Block production cutover (or trigger rollback) and isolate allergy mapping, attachment or balance defects | Continue | F: Record corrected ETL mapping, repaired document links and MRD-approved handling of duplicate UHID candidates |
| F: Record corrected ETL mapping, repaired document links and MRD-approved handling of duplicate UHID candidates | Continue | C: Conduct domain-owner sampling (clinicians, MRD, pharmacy, finance) and inspect all unmapped/duplicate queues |
| D: Zero unmapped safety fields, 100% financial/attachment reconciliation and domain sign-offs complete? | Yes | G: Clinical, MRD, finance and IT leads sign off production cutover and verify live post-load control totals |
| G: Clinical, MRD, finance and IT leads sign off production cutover and verify live post-load control totals | Continue | H: Maintain verified read-only legacy archive access and monitor post-cutover reconciliation queue |
Handle duplicate identities, missing fields and attachments
Hospital migrations fail when IT checks only that "5,000 rows entered the patient table" without noticing that 75 allergy strings were truncated, 55 PDF pointers broke during folder renaming, or open inpatient advance deposits shifted by ₹1.4 lakh due to unmigrated credit notes. Equally dangerous is cutting over without rehearsing how long a rollback actually takes if a critical interface fails at Hour 4 of the maintenance window.
In the MIG-CUT-2026-11 workflow above, decision gate D acts as a hard go/no-go gate. Any unmapped safety field, broken attachment hash or financial variance routes to E, requires ETL correction and full re-verification through F and C, and blocks live cutover at G until every domain owner signs off.
Require representative authorised review and rollback rehearsal.
Require at least two full dress-rehearsal runs (MIG-CUT-2026-11) on production-scale copies plus a timed rollback rehearsal before scheduling live cutover. Have practicing clinicians inspect 50 complex charts side-by-side (legacy screen vs target screen), finance reconcile open AR/deposits/stock to the rupee, and MRD verify attachment integrity.
Software scripts execute extraction, transformation, checksum validation and control-total reports; clinical safety sign-off, identity merges and financial ledger acceptance remain with clinical governance, the MRD head and the finance controller.
Next actions
- Define hard go/no-go acceptance criteria (
MIG-CUT-2026-11) requiring zero silently dropped allergy/alert fields and 100% financial balance reconciliation. - Prohibit automated phone/name UHID merging during migration (
DUP-MIG-01..110), routing candidates to the MRD post-review queue instead. - Verify read-only legacy archive availability and rehearse the exact rollback procedure before the cutover window opens.
Discuss this workflow
Request a workflow assessment focused on this question: What evidence should a provider require before switching to migrated records?
Describe the operation using business information only. Please leave out patient details.
Applying this guide
The scenarios and numbers are illustrative. Confirm these provider-specific inputs before implementation:
- Clinical informatics lead, medical director and nursing/pharmacy representatives: Signed side-by-side clinical chart verification and 100% preservation of legacy allergy/alert banners (`75` cases remediated).
- Medical-records (MRD) head and finance controller: Verified attachment checksum audit (`55` links fixed), duplicate-ID protection (`110` cases) and zero-variance AR/deposit balance bridge.
- IT migration lead and database/storage architect: Completed `MIG-CUT-2026-11` dress rehearsal, timed rollback test and read-only legacy archive verification.
References
- Bahmni registration documentation — Patient identity, visit and document separation example; data-minimisation policy remains a provider decision.
- NRCeS ABDM FHIR Implementation Guide (v6.5.0) — Published FHIR R4 profile reference; pin the exact release and confirm partner conformance before production use.
- Bahmni billing and accounting — Illustrates separation between clinical events, billing and ERP/Odoo accounting; not tax or accounting-policy authority.
Topics: hospital data migration · hospital software data migration · HIS migration checklist · clinical system migration validation
