Medical Data Migration Checklist for Clinics: EMR, Imaging, and Equipment Data

Medical data migration is the process of moving patient records and related data from one system to another, such as from an old EMR to a new one, or from an old imaging system to a new one. A safe migration follows eight phases: plan and scope; clear the compliance and security gates; prepare and map the data; handle imaging and equipment data; test; cut over; reconcile; and decommission the old systems securely. This checklist covers each one.

Key takeaways

• Start months ahead, not weeks. Planning, cleaning, and testing take longer than the transfer itself.
• Sign a Business Associate Agreement (BAA) with every vendor before any patient data moves.
• Take a verified backup of the legacy system before extraction.
• Don’t forget imaging data and the equipment that creates it. Studies, DICOM connections, and data stored on old machines are often overlooked.
• Don’t retire the old system until the new one is reconciled and signed off.
• Wipe or destroy the old drives properly. Retiring equipment without sanitizing it is a breach risk.

This is general guidance, not legal advice. Check your specific obligations with your attorney, compliance officer, and vendors.

What is medical data migration?

Medical data migration moves records and patient information from one storage location, platform, or software to another. It’s needed when you switch EMRs, merge practices, upgrade a PACS, move to the cloud, or replace imaging equipment that stores or sends patient data.

Where does patient data live in an imaging practice?

Phase 1: Plan and scope

• ☐ Name a project owner and a steering group (physician, practice manager, IT, records, a clinical super-user)
• ☐ Inventory every system that stores patient data: EMR, PACS, RIS, billing, lab interfaces, modalities, workstations, backups, and paper
• ☐ Decide what moves: all data or a date range, active vs. archived, structured vs. scanned
• ☐ Decide retention for what you don’t migrate (see the California note below)
• ☐ Set acceptance criteria and rollback triggers before you start
• ☐ Budget for contingency and for legacy access after go-live
• ☐ Set a timeline. This one is illustrative, and your vendors’ schedules govern:

Phase 2: Compliance and security gate

• ☐ Sign a Business Associate Agreement with the new vendor and any migration partner before data moves
• ☐ Confirm encryption in transit and at rest
• ☐ Set up role-based access and audit logs for the whole project
• ☐ Confirm any cloud tool used is HIPAA-compliant for storage and transfer
• ☐ Take a complete, verified backup of the legacy system before extraction
• ☐ Limit access to staff who need it
• ☐ Review state privacy rules with your attorney (California has its own medical-privacy law, the Confidentiality of Medical Information Act)

Phase 3: Prepare and map the data

• ☐ Profile the data: find duplicates, incomplete charts, and inconsistent formats
• ☐ Clean first. Don’t import messy data into the new system
• ☐ Map every field from the old system to the new one, and note required fields the old system never had
• ☐ Define transformation rules (for example, medication status and lab codes) and document them
• ☐ Decide how history is handled. Many EMRs store an item each time it’s updated. One common approach is to migrate the latest instance of each item to avoid duplicates. Agree on this with your clinicians
• ☐ Plan for patient-matching failures. Options include fixing the legacy record, adding the patient to the new system, mapping one-to-one, or extracting manually when mismatches are rare
• ☐ Decide how unstructured data and scanned documents will move

Phase 4: Imaging and equipment data (the step most checklists skip)

If you’re replacing, adding, or moving imaging equipment, your migration includes the machines.

• ☐ List every modality: make, model, serial number, location, and its network details (IP address and DICOM AE title)
• ☐ Record where each system sends studies (PACS, cloud, workstation)
• ☐ Confirm what each system stores locally and for how long, because many imaging devices keep data until it’s sent to your clinical systems
• ☐ Confirm every study is safely archived before an old system is retired
• ☐ Plan PACS or archive migration with your PACS vendor, including patient, study, series, and image counts, and validate that images open and metadata is intact
• ☐ Confirm prior studies appear alongside new ones for comparison
• ☐ Configure the new system’s network settings: DICOM nodes, routing, and worklist or order interfaces
• ☐ Run test studies from every modality end to end before go-live
• ☐ Tag new equipment and update your asset inventory
• ☐ If you’re relocating equipment, include PACS and DICOM re-integration in the plan. See our guide to preparing for imaging equipment relocation

Phase 5: Test and validate

• ☐ Run a pilot batch and compare it with the source
• ☐ Have clinical super-users verify the data (user acceptance testing)
• ☐ Reconcile counts of patients, studies, and documents
• ☐ Spot-check high-risk fields: allergies, medications, problem lists
• ☐ Test interfaces and security controls
• ☐ Rehearse the rollback

Phase 6: Cutover (go-live)

• ☐ Schedule the cutover for off-hours or a weekend
• ☐ Run a catch-up (delta) extract about a week before go-live to capture records added since the first extract
• ☐ Set a freeze window and downtime procedures (paper forms, phone numbers)
• ☐ Train staff by role before go-live
• ☐ Arrange day-one support

Timing depends on volume. As one example, migrating 10 years of medications, allergies, problems, and scanned documents can take up to about a week of live migration, and larger projects are often phased across several weekends.

Phase 7: Reconcile and monitor

• ☐ Reconcile the final counts and close critical exceptions
• ☐ Get clinical and technical sign-off in writing
• ☐ Keep read-only access to the legacy system for a defined period (many guides suggest 6 to 12 months)
• ☐ Monitor errors and data accuracy and fix mapping issues
• ☐ Keep audit evidence from the project

Phase 8: Decommission old systems and equipment safely

Don’t retire the source until the migration is signed off and your retention obligations are met.

• ☐ Confirm sign-off and retention decisions first
• ☐ Inventory every device that holds PHI: workstations, servers, imaging systems, backup media
• ☐ Sanitize storage per NIST SP 800-88 (clear, purge, or destroy), verify it, and document it. HIPAA requires procedures for the final disposition of electronic media (45 CFR 164.310(d)(2))
• ☐ Sign a BAA before any vendor takes media, and get serialized certificates of destruction and chain of custody
• ☐ If a device is being sold, traded in, or returned, wipe it before it leaves your control. See ECRI’s guidance on decommissioning medical devices
• ☐ De-install, tag, and remove the device from the network, and update your inventory
• ☐ For California X-ray machines, report retired, transferred, or moved machines to the Radiologic Health Branch
• ☐ Keep the documentation (HIPAA documentation is generally kept for six years)

California record retention: what to know

Rules vary by provider type, so confirm with your attorney or the Medical Board. Commonly cited baselines:

• Adult records: at least seven years (physicians under Business and Professions Code section 2266; licensed facilities under Health and Safety Code section 123145 when they cease operating).
• Minors: at least one year after the patient turns 18, and never less than seven years.
• Medi-Cal providers: many guides cite a longer period (ten years). Confirm yours.

Retention determines what you can safely archive instead of migrate, and how long you must keep the old system or an archive available.

Common mistakes

1. Migrating before cleaning
2. Skipping the catch-up extract
3. Forgetting prior imaging studies and DICOM connections
4. Retiring old equipment without sanitizing its drives
5. No rollback plan
6. No BAA with the vendor
7. Shutting off legacy access too soon

How VectoRay Medical helps

VectoRay Medical provides data migration services using a four-step process: data analysis, data structuring, data conversion, and migration, transferring records item by item to protect integrity. We can migrate all data or a selected range, run a catch-up extract before go-live, and help resolve patient-matching exceptions. For equipment, we facilitate decommissioning, tagging, and networking updates on new systems across California and surrounding states, backed by our equipment repair and preventative maintenance teams. Whoever you choose, including us, should sign a Business Associate Agreement before any patient data moves.

Request a data migration consultation or call 1-855-409-2885. For a broader framework, the federal Health IT Playbook also offers EHR transition resources.

Frequently asked questions

What is a medical data migration checklist?
A phased list of tasks for moving patient data safely between systems: planning, compliance, data preparation, imaging and equipment data, testing, cutover, reconciliation, and decommissioning.

How long does medical data migration take?
It depends on volume and complexity. Planning and cleaning often take weeks or months, and the live cutover can take from a weekend to about a week for large datasets, often phased over several weekends.

What data should be migrated?
At minimum, the data needed for continuity of care: demographics, active problems, medications, allergies, and recent visits, plus any required scanned documents. Older records are often archived instead.

Do I need a Business Associate Agreement?
Yes, with any vendor that handles patient data on your behalf, before data is transferred.

What happens to patient images when we replace an X-ray, ultrasound, or CT system?
Confirm all studies are archived in your PACS or archive before the old system is retired, configure the new system’s network settings, and test it end to end. Then sanitize the old system’s storage.

How do we safely wipe old imaging equipment?
Follow NIST SP 800-88 (clear, purge, or destroy), verify the result, and keep records. Use a vendor with a BAA and serialized certificates of destruction.

How long must California clinics keep medical records?
A commonly cited baseline is seven years, with longer periods for minors and potentially for Medi-Cal. Confirm your exact obligations.

What’s the biggest risk in a data migration?
Data loss or corruption from poor planning, missing validation, or retiring the old system too early.