New Digital-Health Work Is Waiting on Servers Nobody Can Change.

The renewal notice arrives in the finance head’s inbox. It is for the third and last year of paid security updates on the servers under the hospital’s main applications.

The same week, the digital team brings a plan for connected health records and faster insurer claims. Both need the billing and registration applications to change, and both sit on those servers.

The finance head asks what two years of updates have bought. The honest answer: another year on the same servers, and a plan that cannot start.

What We Found

We looked at two things: what the public record says about the dates on which old servers stop being fixed, and what India’s digital-health programme now asks of the systems hospitals run.

The paid years end too. Support for Windows Server 2012 and 2012 R2 ended on 10 October 2023, and the paid security updates sold after that ran to 13 October 2026. For the database underneath, extended support for SQL Server 2016 ended on 14 July 2026. Paid security updates are time bought from the maker, and the maker sets when they stop.

India’s digital-health programme now asks for connected records. On 17 July 2026 the National Medical Commission directed medical colleges to implement an “Ayushman Bharat Digital Mission (ABDM)-compliant Health Management Information System (HMIS)” in their hospitals “immediately”. It published lists of non-compliant colleges, among them some “still not using ABDM-enabled HMIS software”, and warned that its rating board “may initiate further action as per norms”.

There is also a reward for connected records. Under the Digital Health Incentive Scheme, hospitals “earn cash incentives for creating interoperable digital health records”. By 18 June 2026 the scheme had paid hospitals more than 107 crore rupees.

Insurers now work to the hour. The insurance regulator’s circular of May 2024 requires insurers to “decide on cashless authorisation requests within one hour”, and to give final authorisation on discharge “within three hours of request from the hospital”.

Replacing everything at once is feared for good reason. A US Government Accountability Office report of February 2025 found that the US Department of Veterans Affairs is replacing a record system that “has been in operation for more than 30 years”. It paused the roll-out in April 2023 after five sites, and by mid-2024 had committed about 12.71 billion dollars. This is far larger than anything our readers run, but it is what leaders picture when they hear the word replacement.

The Work That Waits on an Old Stack

The renewal notice offers two prices: the renewal and an upgrade. The question that decides the matter is in neither: what can the organisation not do while its applications stay where they are?

Connected records. An ABDM-compliant record system has to exchange records with the national network. An application written for an operating system nobody fixes, that nobody can change, is a hard place to start. On Windows Server 2008 R2, even today’s standard for encrypted connections, TLS 1.2, is “Disabled” by default.

The incentive. A hospital whose applications cannot create interoperable records cannot earn the incentive for creating them.

Faster claims. The insurer’s one-hour and three-hour clocks start with the hospital’s request, and the billing application on the old server sits behind every request.

This is our reading of the evidence. It is not a measured market figure, and we do not put a rupee value on it here. That figure has to come from your own organisation.

Four Ways to Answer the Maker’s Date, Weighed

Option	When it fits	What it risks
Buy extended support each year	A retirement or replacement already has a firm date	The applications stand still, the new work waits, and the option ends on the maker’s date
Upgrade the operating system in place	The applications are known to run on the newer version	Old applications often stop on the new version; the upgrade turns into a rewrite nobody planned
Replace every old application at once	The applications are few, small and well understood	Every department changes on one date. The record of what the old applications do is still missing
Write down each application, then move it module by module onto supported technology	The applications are old, built around the hospital’s own ways of working, and used every day	Two systems run side by side for a time, and for a time you pay for both. The work runs over several stages

Where You Are Now, and Where You Should Be

Before the next renewal is signed, we would set a benchmark for the decision itself.

Measure	Typical starting point	Where it should be	How it is checked
The cost of staying	The renewal fee alone	The renewal, old hardware, exceptions and staff time, in one place	The cost comparison
The cost of leaving	One large figure, never broken down	A price for each stage	The staged plan and quote
The digital-health work waiting on the old stack	Not linked to any server	Each planned piece listed against the application it needs	The staged plan
Whose date the plan follows	The maker’s	The organisation’s own, set before the maker’s	The staged plan
What each year of paid updates buys	The same servers, one year older	Fewer applications on unsupported machines at the end of each year	The count, reported at each renewal
The size of one commitment	Every application at once, or nothing	One stage, with the freedom to pause after any accepted module	The staged plan

The starting points above are what we expect to find. In an engagement they are replaced by your own position, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a healthcare organisation.

How We Work With You

1. We listen: a free Reliability Review. A first conversation about the old servers, the renewal, and the digital-health work that is waiting on them. You leave with a short written note of what we found.
2. We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This article is an example of that work.
3. We read the system and propose: the Legacy System Specification Assessment. It produces a written specification of what the system does, a risk register, a cost comparison between keeping and replacing the system, and a staged plan with a fixed quote. AI does a first pass, our senior engineers review it and trace it to the code, and your own experts confirm it. Code access is read-only and logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage. You get the options and our recommendation.
4. If you approve, we build. We replace a system one module at a time while the old one keeps running, onto technology that is still supported. We never do a single cutover. The work is billed by milestone, each milestone tied to a module you accept, and you can pause after any accepted module. Where a module touches clinical work, accepting it is your clinicians’ decision.
5. We review against the benchmark. Before work starts we set the benchmark. After each module we show you where each measure stands, and the filled-in benchmark is yours at the end.

The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The assessment fee is credited in full against the first build stage if it starts within 90 days of the report.

What you need to bring: a start made while paid updates can still be bought; a budget for the assessment, approved separately from the renewal; read-only access to the code once the assessment begins; and a few hours from the people who use the applications every day.

Meeting the Commission’s direction, or any other rule, is your organisation’s own work; we do not offer a compliance service.

What changes for the business:

Role	What they gain
CEO	The organisation leaves on a timetable it chose. New services are not tied to a maker’s calendar.
CTO or CIO	Applications move onto technology that is still supported and that people can be hired for, without a forced rush.
CFO	The cost of staying set beside the cost of leaving, a price for each stage, and spending that comes to an end.
COO	Departments change one application at a time. There is no single switch-over day for the whole organisation.
CISO	Fewer machines nobody fixes after every stage, and fewer exceptions to renew.

The cases in this article, and what IOanyT does about that kind of problem:

The case	What IOanyT does
The US Department of Veterans Affairs, a US Government Accountability Office report of February 2025 found, paused the roll-out of its new record system after five sites, with about 12.71 billion dollars committed by mid-2024.	Our part is far smaller than this case, and we do not work on health record systems of that kind. For the applications we take on, we assess before we price and replace one module at a time, with the old application still running.
The National Medical Commission published lists of medical colleges not compliant with its direction on connected records.	Our assessment shows which application stands in the way and what moving it would take. Meeting the direction is the college’s own work.

IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. The maker set the date the fixes stop; the order in which your applications move can be yours.

Book a free Reliability Review →

Get a fixed quote →

See the Legacy System Specification Assessment →