Hospitals Keep Every Old Record. What Goes Missing Is What the Records Mean.
We looked for the public record on hospital data held in old formats and found almost none. Here is what the record does show, why old records go out of reach, the four ways forward, and the benchmark we would set.
A patient returns to the hospital after eleven years. The doctor asks what was done last time.
The new system has no record of it. It went live six years ago, and only the last two years of history were brought across. The earlier record exists. It is in the old system, which still runs on a machine in the IT room.
A request goes to IT. Two days later a printout arrives. Half the fields are codes: status 7, type C, flag 3. The one person who knows what they mean is on leave.
The paradox: The hospital has kept every record it ever made, and cannot read most of them.
What We Found
Before we suggest anything to a hospital group, a laboratory chain or a pharma company, we study its sector. For this article we went through the public record on health data held in formats only an old system can read: published cases, audits, surveys and the documentation of newer tools.
Five findings stand out. The first is about what is missing.
The public record holds almost nothing on this in healthcare. We found no named hospital, laboratory or pharma company with this problem, no survey of it, and no figure for how long an old record takes to find or what an archive costs to keep. Each fact below comes from outside this issue or outside healthcare, and is used for one narrow point.
A health record system can run for decades, and hold decades. A US government audit of February 2025 records that the record system the US Department of Veterans Affairs relies on “has been in operation for more than 30 years”. That is far larger than anything our readers run, in technology we do not work on, but it shows how much one system can come to hold.
Some old data can be reached only through screens. One vendor’s case study, undated, describes a US healthcare organisation whose administration system was built on thousands of old terminal screens, many unchanged for decades. Where a screen is the only way to see a record, the record is only as reachable as the screen.
Newer tools say plainly what they can read. One widely used cloud service for building AI assistants lists its supported source-file formats as .txt, .md, .html, .doc/.docx, .csv, .xls/.xlsx and .pdf, and sets a size limit for each file. Structured data stores are reached through a query engine. An old system’s private tables and screens are none of these until a step is built to bring the data out.
And the store under the records ages too. For SQL Server 2012, one widely used database, extended support ended on 12 July 2022, and the paid updates sold after that ended on 8 July 2025.
Our reading is that the data is rarely lost. Its meaning is. The database holds “status 7”; only the old program, and a few people, know what 7 stands for.
What our review does not show: We found no healthcare evidence on data locked in old formats: no named case, no survey and no figure. The facts above are cross-sector or come from other parts of healthcare, and none is about a mid-size hospital. The screens figure comes from a vendor’s undated case study, and we do not use its result. The file formats are one provider’s list on the day we read it, and such lists change. We did not research how long medical records must be kept, who may see them, or what India’s data protection rules require, and this article says nothing about them. That the meaning, not the data, is what goes missing is our reasoning, not a measured finding.
What Waits While Only the Old Program Can Read the Records
Old records are usually treated as a storage matter. Our reading is that they hold the organisation back three ways.
The first is the archive itself. The old system cannot be switched off, because it is the only way into the records, so it keeps its server, licence and backups for a few lookups a week.
The second is knowledge. Each year, fewer of the people who understood its codes are still there.
The third is what cannot be built. A reporting tool, an AI assistant or a link to newer services each needs data in a form it can read, with its meaning attached.
The gap we see: most health organisations know their old system holds years of records. Few can say what each table, field and code means without asking the one person who remembers. An organisation that has it written down can move its records, retire the old system and point new tools at its history. One that does not keeps a locked room running.
This is our reading of the evidence. It is not a measured market figure.
Four Ways Forward for Old Records, Weighed
There are four real options. Each one is right for somebody.
| Option | When it fits | What it risks |
|---|---|---|
| Keep the old system running as a read-only archive | Lookups are rare, and an end date for the archive is already set | The database and machine under it go out of support, the people who understand it leave, and new tools still cannot read it |
| Dump the old tables to files and switch the system off | The data is simple and its codes are already written down | Files of codes with no meaning attached. Nobody can show that what was dumped is complete |
| Move every old record into the new system at once | The old data is small, recent and well understood | Every mismatch between old and new is decided under pressure, on one date, with no way to show what arrived |
| Write down what the old data means, then move it with each module and check each stage | The records are old, coded, and still asked for | It runs over several stages. Some codes will turn out to have no explanation anyone can recover |
Our recommendation: start with the meaning, not the move. Write down what each table, field and code means, confirmed by the staff who used it, and list what nobody can explain. Then move the data module by module as the system is replaced, and check each stage before the next begins. The old system keeps running until the last stage is accepted. We do not run archives, and we do not advise on how long any record must be kept or who may see it.
Where You Are Now, and Where You Should Be
A recommendation is only useful if you can tell later whether it worked. So before any work begins we set a benchmark: a few measures taken from your own systems, each with a target. For this issue it would start like this.
| Measure | Typical starting point | Where it should be | How it is checked |
|---|---|---|---|
| What the old system holds | Known to a few people | Each table, field and code written down, with what could not be explained listed | The specification |
| Who can read an old record | One or two people in IT | Anyone trained, following written steps | A sample lookup by someone new, checked by records staff |
| Records reachable without the old program | None | Every record in scope, in its new home | Sample lookups, old and new side by side |
| The archive’s end date | None; “kept for reference” | A date, tied to the last stage | The staged plan |
The starting points above are what we expect to find. In an engagement they are replaced by your own figures, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a healthcare organisation.
How We Work With You
- We listen: a free Reliability Review. A first conversation about the old system, the records in it, and what is waiting on them. You leave with a short written note of what we found. You can start with a conversation about the system; we ask for read-only code access only when the assessment begins.
- We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This article is an example of that work.
- We read the system and propose: the Legacy System Specification Assessment. It produces a map of the system as it stands, a written specification of what it does, a risk register, a cost comparison between keeping and replacing the system, and a staged plan with a fixed quote. AI does a first pass, our senior engineers review it and trace it to the code, and your own experts confirm it. Code access is read-only and logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage. You get the options and our recommendation.
- If you approve, we build. We replace a system one module at a time while the old one keeps running. We never do a single cutover. Each module has a traceability matrix. The work is billed by milestone, each milestone tied to a module you accept, and you can pause after any accepted module. Where a module touches clinical work, accepting it is your clinicians’ decision.
- We review against the benchmark. Before work starts we set the benchmark. After each module we show you where each measure stands, and the filled-in benchmark is yours at the end.
The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The assessment fee is credited in full against the first build stage if it starts within 90 days of the report.
Our code-access terms cover code, not patient records. Who may see any real record is for your organisation and its advisers to decide, and is agreed before any record is opened. Switching the old system off is your team’s decision. The older technologies we read include VB6, Delphi, AngularJS, PHP 4 to 8, Java 8, .NET Framework and classic ASP. We do not work on packaged health record products or their own formats, and we do not offer a compliance or legal service.
What changes for the business:
| Role | What they gain |
|---|---|
| CEO | The organisation can answer for its own history when a patient, an insurer or a court asks. |
| CTO or CIO | A written description of the old data: what each table and code means, no longer held in one memory. |
| CFO | Old bills and claims can be found when a dispute or an audit asks, without days of specialist effort. |
| Medical head | A clinician can see a returning patient’s earlier history, not only what the newer system holds. |
| Risk and compliance | A request for an old record can be answered in a known time, with confidence that it is complete. |
The cases in this article, and what IOanyT does about that kind of problem:
| The case | What IOanyT does |
|---|---|
| The record system the US Department of Veterans Affairs relies on has been in operation for more than 30 years. | Our part is far smaller than this case, and we do not work on record systems of that kind or in their technology. For an organisation’s own applications, we write down what the system does and stage its replacement. |
| An unnamed US healthcare organisation’s administration system was built on thousands of screens. | We do not work on COBOL or mainframes. The lesson we take is narrower: data reachable only through screens needs its meaning written down before it can move. |
IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. We start with what the old data means, because that is the part that leaves with the people who knew it.
Sources
- GAO-25-108091, 24 February 2025
- A vendor's case study
- A cloud provider's documentation
- connectors page
- Microsoft, SQL Server 2012
In this issue
Data locked in old formats
Research note 2
New Digital-Health Work Is Waiting on Records Only an Old System Can Read.
An old system kept running only for its records holds back reporting, AI and connected records. Four ways to handle the archive and a benchmark.
Research note 3
Data a New Tool Cannot Read Is Not Ready. Here Is the Benchmark for Ready.
A new reporting or AI tool sees only the years it can reach. The benchmark we would set before old hospital data goes to any new tool, and the path.
Issue study
When the Old System Is the Only Way Into the Archive
Hospital records only an old system can read: what the thin public record shows, what digital health now rewards, the options and our benchmark.
More from Healthcare
Harm to patients when systems go down
How Much of What Care Rests On Have You Mapped? Four Measures, Now and Where They Should Be.
Dependence on an outside suppliers systems
How Much of Your Own System Do You Hold? Four Measures, Now and Where They Should Be.
Replacement is costly and risky