01

Prepare and protect

Resolve access, ownership, contracts, and export rights before setting a cutover date.

  • Identify account owners and obtain administrative access.
  • Inventory patients, charts, documents, photos, forms, appointments, balances, products, inventory, and reports.
  • Confirm export formats, costs, timelines, and post-termination access.
  • Define retention, legal-hold, BAA, security, and deletion responsibilities.
02

Map and validate

A successful import count does not prove the records are usable.

  • Map identity, demographics, providers, locations, services, statuses, dates, and identifiers.
  • Test representative complex records, not only clean examples.
  • Validate permissions, charts, photos, forms, schedules, inventory, checkout, and reporting.
  • Record exceptions and assign an owner for remediation.
03

Cut over with control

The cutover plan should state exactly what stops, what starts, and how the clinic responds if validation fails.

  • Set a source-system freeze and final delta process.
  • Communicate role-specific timing and downtime procedures.
  • Run smoke tests before opening patient-facing access.
  • Reconcile totals and spot-check records after launch.
  • Preserve the old system or archive until contractual and regulatory requirements are satisfied.

Clinical and operational references

Use this guide as an operational starting point, not legal or medical advice. Clinic requirements vary by jurisdiction, services, licensure, and scope of practice.

ONC SAFER Guides ↗HHS HIPAA Security Rule ↗CDC core infection-prevention practices ↗