HC-DATA-041 / HEALTHCARE
Control survived the cutover
A regional care network separating clinical and operational records from a retiring shared platform.
Context
Twelve applications held overlapping patient, scheduling, billing, document, and audit records. Contractual timing was fixed, but future-use and archive-access decisions were not.
The problem beneath the brief
The initial program treated migration as a volume exercise. It could count records but could not explain which source remained authoritative, who approved disposition, or how users would reach retained records after cutover.
- 12
- systems dispositionedapproved source and disposition register
- 4
- acceptance gatesrelease and handoff record
- 2
- pre-cutover blockers caughtexception and decision log
Risk constraints
What could not be traded away.
- clinical continuity during cutover
- minimum-necessary access
- retention by record class
- provenance across transformed records
- recovery without reopening the retiring platform
Findings
What inspection changed.
- three sources claimed authority over the same appointment state
- an inherited entitlement crossed an intended archive boundary
- two retained workflows depended on a service omitted from the first recovery plan
Architecture
The operating system we installed.
- 01record-class disposition registerfour acceptance gates
- 02versioned mappings and reconciliation ledgerdual approval for disposition changes
- 03read-only archive with role-scoped accesssampled content validation
- 04event and exception audit streamaccess-denial tests
- 05cutover and rollback orchestrationrestore rehearsal
Delivery sequence
Four gates. No ceremonial phase changes.
- 01
Frame
Define the decision, outcome, work products, authority, dependencies, exclusions, and acceptance evidence.
A named sponsor and principal approve the bounded charter. - 02
Inspect
Observe the operating reality, trace systems and records, test assumptions, and rank failure modes.
Critical unknowns have owners, evidence plans, and stop conditions. - 03
Build
Implement the smallest coherent change with versioned decisions, controls, and verification attached.
The integrated state meets the agreed evidence threshold. - 04
Transfer
Rehearse recovery, resolve exceptions, accept the work, remove temporary access, and transfer operating ownership.
The receiving owner signs the handoff with open limits visible.
Complications
Where the plan had to become more honest.
- A clean aggregate count hid duplicate clinical documents with different provenance.
- The first restore rehearsal recovered the archive but not the identity dependency required to open it.
Outcomes
What changed—and what the record proves.
- Every retained record class had an approved future-use decision and receiving owner.
- Two release blockers were found before cutover and resolved before the gate reopened.
- The retiring environment closed with no unresolved critical exception in the handoff record.
Lessons
What we would carry into the next system.
- Future use is a business and domain decision before it is a mapping decision.
- Reconciliation must prove meaning and access, not only row counts.
- A recoverable archive includes identity, documentation, ownership, and practiced access.
Handoff
The engagement ended with an operating owner.
- 01accepted archive and mappings
- 02open low-severity exceptions with owners
- 03access and escalation matrix
- 04quarterly restore rehearsal
- 05retention-review calendar
Start with the decision
Bring the priority. We will help bound the work.
If the decisions or constraints look familiar, start with the operating reality—not a preselected solution.
Start a conversation.