The HHS Office for Civil Rights breach portal, which lists reported breaches affecting 500 or more individuals, records a running total of affected individuals since 2009 that exceeds 935 million as of January 2026. That figure reflects reported affected records across all breach causes and may count individuals more than once rather than representing unique people. It is context for the scale of exposure, not a measure of legacy-system breaches specifically. Source: the HHS Office for Civil Rights Breach Portal. Unsupported legacy systems that no one patches or monitors add to that exposed surface, whatever share of past breaches they account for.

This is a data-discipline problem, not a data shortage. Retiring the system is the goal. Losing access to the money and records it still holds is not.

This guide covers what a health system must preserve when it retires a legacy system, who needs continued access and why, the events that trigger an archiving decision, what keeping the system alive actually costs, and what separates a governed archiving solution from a storage bin.

What Is Healthcare Data Archiving?

Healthcare data archiving, also called active archiving, extracts patient and administrative data from a legacy clinical, financial, or administrative system before the health system retires it and preserves that data in a format that keeps it secure, auditable, and available to the people who still need it.

A passive archive stores data. An active archive keeps it structured, governed, and usable, which is what lets the source application be shut off without anyone losing the access their role requires. As part of a legacy application decommissioning strategy, active health system data archiving is the table stakes. The distinction that decides whether cost actually leaves the books is programmatic, portfolio-scale application retirement: running many applications through one repeatable process, retiring the contract rather than only extracting the data, and owning the work from rationalization through decommissioning under a single accountable line. Extracting data preserves the record. Terminating the contract is what removes the cost.

Common Triggers for Healthcare Data Archiving

• Archiving is not the starting point. It is what happens after a health system hits one of a few triggers for legacy application decommissioning, each leading to the same downstream problem: legacy data with nowhere permanent to live. Whether an organization needs clinical data archiving or medical data archiving for specific system types, a health system that only archives when a trigger forces it repeats the exercise after every migration and every deal.
• Application rationalization: A system gets flagged for retirement because it is redundant, underused, or duplicative of a newer platform, and its data still needs somewhere to go. This is the trigger IT leaders bring to the conversation most often. Our guide to healthcare application rationalization covers how systems get flagged in the first place.
• EHR or EMR migration: The organization moves to a new clinical system, and the prior EHR's historical record set cannot disappear once go-live happens. That history has to remain accessible to clinicians long after the old system is dark.
• Merger and acquisition activity: An acquired entity brings its own application portfolio, and a Transition Services Agreement puts a clock on how long the seller or former parent will provide access and support for a system the combined organization has no interest in paying for. How application portfolio management accelerates M&A value covers this trigger in more depth.
• Vendor end of life: The vendor sunsets the product, drops support, or gets acquired, and the health system loses the ability to keep the system running safely whether it planned to retire it or not. This is the trigger that arrives on someone else's schedule, which is why the data has to outlive both the application and the vendor.

The trigger changes, but the archiving decision does not. Whichever door the organization walked through, the work starts the same way: sorting what actually has to be kept.

What Must Be Preserved When a System Is Retired

Not every field in a legacy system carries the same retention obligation, and treating all of it as equally urgent is how archiving projects get bloated and expensive. The work starts with sorting what has to be kept, for how long, and under whose authority.

• Clinical records: Encounter notes, diagnostic results, and medication history. The HIPAA designated record set (DRS) is broader than clinical data alone and can include billing and other records used to make decisions about an individual, so DRS obligations cut across the clinical, financial, and administrative categories below rather than sitting only here. This is the core of what a clinician will look for at the point of care years after the source system is gone.
• Financial and billing data: Claims history, patient accounting, and accounts receivable records, particularly when a retirement happens mid-collection cycle. Cutting off access to this data early strands revenue the organization is still entitled to collect.
• Administrative and HR data: Records tied to compliance obligations that outlive the application itself and still have to be produced on request.
• Imaging: DICOM and PACS data carries its own retention and access requirements, separate from structured clinical data. It also has to be extracted, normalized where necessary, indexed, validated, and made viewable once the source system is gone, rather than merely copied into storage. Buyers underestimate imaging, and it is where archiving projects stall.

The table below shows how the four data types differ on the variables that drive the work: retention authority and the access the archive has to preserve.

Retention length is not uniform. HIPAA requires covered entities to retain certain documentation specified by the HIPAA Rules, but the HIPAA Privacy Rule does not itself establish a medical-record retention period; state laws generally govern how long medical records must be retained. CMS requirements and other applicable obligations may also affect retention. Retention therefore has to be determined by data type, jurisdiction, and applicable requirements rather than through one blanket period for an entire archived portfolio.

Who Gets Access After the System Is Gone

• Retiring the system does not remove the obligation to produce its data, and the organization has to meet that obligation without the original application in place. A comprehensive health system data archiving approach ensures that each function relying on the old system has its access re-established inside a governed archive.
• HIM teams: need continued Release of Information capability against archived records, with real search rather than degraded lookup into a static file dump.
• Clinical staff: need point-of-care access to historical records without leaving their current EHR workflow. Once several systems have been retired, clinicians should reach that history through a single point of retrieval rather than a separate lookup per retired system.
• Compliance and legal teams: need audit-ready, role-based access for record requests, litigation holds, and regulatory inquiries, with every access event traceable.
• Patients: retain a right to access their own records after the source system is retired, so the archive has to preserve patient access through the EHR or patient portal, an API, or another governed retrieval path. HIPAA gives patients a right of access to their records, and the Cures Act framework governs electronic access and information blocking, both of which survive the retirement of the system that created the record.
• Finance: needs continued access to legacy billing and accounts receivable data through the wind-down period. Finance also needs the retirement itself reflected in the budget, because eliminating a legacy system's licensing and maintenance cost is what turns an archiving project into a recurring net operating-expense reduction.

Role-based access, single sign-on (SSO), and governed patient and API retrieval keep archived data inside the same governance perimeter as live systems, so a retired application does not become a second, unmonitored access path.

What It Costs to Keep the System Alive

Most health systems can name the licensing line on a legacy application. Far fewer can name the full carrying cost, which is what makes archiving look optional when it is not. That cost runs well past licensing: maintenance, hosting, third-party support, cybersecurity tooling, and the internal staff capacity spent keeping a system alive that nobody uses for anything except lookups. Terminating the contract removes it.

The budget mechanics matter too. Some implementation costs may qualify for capitalization, subject to the health system’s accounting policies, so finance should classify the CapEx and OpEx treatment before the project gets sequenced. For most health systems the gate is capacity rather than capital: the budget exists, but the internal bandwidth to run extraction, validation, and decommissioning alongside everything else on the roadmap does not.