Moving from old hospital software without losing a single record

Many hospital owners would like better software and still hesitate to change. The reason is almost always the same, and it is a good reason: years of patient history are sitting inside the old system, and nobody wants to be the person who lost it.

That fear is reasonable. Records do get lost in badly run switches. A clinic in Alberta, Canada, permanently lost almost two years of patient records when it moved from one system to another, according to the province's privacy commissioner. It does not have to go that way. A careful move is slow in the right places and fast everywhere else.

First, whose data is it?

It is not your software vendor's. The Health Ministry's EHR Standards of 2016 describe the hospital as holding records "in trust" for the patient, who owns the health data in them. Your vendor is neither the owner nor the trustee. It is a service you pay for.

The Digital Personal Data Protection Act, 2023 takes the same view from the other side. Under Section 8, the hospital stays responsible for personal data processed on its behalf "irrespective of any agreement to the contrary", and it can use a vendor only under a valid contract. The rules that put most of these duties into force were notified in November 2025 and, as notified, start applying around May 2027. That is close enough that any software contract you sign today should already be written with them in mind.

In plain words: the data is yours to look after, and the right to a usable export comes from your contract. Before you sign with any vendor, including a new one, settle in writing how you would get all of it back.

How long you must keep the old records

The Medical Council's 2002 ethics regulations, which still apply, ask for indoor patient records to be kept for at least three years from the start of treatment, and for copies to be given within 72 hours when a patient or a legal authority asks. NABH does not fix a number of years, but it does expect a written retention policy and a unique identifier on every record. In practice many hospitals keep far longer: MLC records until the case is closed, and children's records until they turn eighteen.

Your billing records have their own clock. Wherever you issue GST invoices, accounts and records have to be kept for 72 months from the due date of the annual return. So the old system's data is not something you can quietly let lapse once the new one is running.

What a careful switch looks like

1. Get a full export, and look at it. Ask the old vendor for everything: patients, visits, prescriptions, reports, bills, payments, advances and price lists. Then open the files. Exports sometimes miss a table that everyone assumed was there.

2. Keep your patient IDs. Patients carry their old ID cards, and your old files refer to those numbers. The new system should keep the old ID against each patient, so anyone can be found by the number they bring in. This is also the moment to clean up duplicates, the same person registered twice with a slightly different spelling, so you do not carry the mess into the new system.

3. Do a test import first. Move a sample, then a full copy, into the new system before anything goes live. Let your own staff look up patients they know and check that the history is right.

4. Count everything twice. The number of patients, the number of visits, the bills by month, the total outstanding, and each patient's advance. The counts in the new system should match the old one, and someone at the hospital, not only the vendor, should sign off that they do.

5. Plan the billing cut-over. Where you issue GST invoices, the numbers must be unique within the financial year. The new software has to either continue your current series or start a new one that cannot clash with it. Many hospitals pick the first of a month for the switch, so the accounts are clean on both sides.

6. Train every desk on its own work. Reception does not need to learn the pharmacy screens. Train each person on the few screens they will use every day, on your own workflow, before the go-live day, not after it.

7. Keep a read-only copy of the old data. Even after a clean migration, keep the original export safe for as long as the retention rules above require. If anyone ever questions a record, you can show where it came from.

Plan for the bad day too

In November 2022 a ransomware attack took down the systems at AIIMS, New Delhi. For days its emergency, OPD, wards and labs ran in manual mode. It showed how much a tested backup matters, for a hospital of any size. Switching software is a good time to ask your new vendor how backups work, where the data is kept and how quickly you can be running again if something goes wrong.

Please note: this article is general information, not legal or tax advice. Record-keeping rules can differ by state and by the type of record. Check with your adviser for your own hospital.

Sources

• Ministry of Health and Family Welfare, Electronic Health Record Standards for India, 2016. PDF
• Digital Personal Data Protection Act, 2023, Section 8. PDF
• Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025. PDF
• Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, clauses 1.3.1 and 1.3.2. Text
• NABH Hospital Accreditation Standards, 6th edition, January 2025, IMS.3 and IMS.6. PDF
• CGST Act, 2017, Section 36 (keeping accounts), and CGST Rules, Rule 46(b) (invoice numbering). Section 36, Rule 46