Retiring a Legacy ERP in Healthcare: HIPAA, CMS, and the Data You Can’t Lose

Hospitals and health systems were among the biggest Lawson customers for two decades, and they’re now among the biggest migrators — to Infor CloudSuite, Workday, Oracle Cloud. Every one of those projects leaves a legacy ERP behind holding data that a health system is obligated to keep and obligated to protect.

This is a practical guide for the IT director or application manager who owns that system.

What’s in a hospital’s legacy ERP

More than most industries, and more regulated:

• Payroll and HR for a large, credentialed workforce: pay history, deductions, benefits enrollment, job and position history, license and certification records. Often the employee health-plan data that falls under HIPAA as a group health plan.
• Supply chain: item master, POs, receiving, par levels, and the vendor history that matters for recalls, contract disputes, and cost analysis.
• GL and cost accounting: the data behind Medicare cost reports and the audited financials.
• AP: vendor payments, 1099s, and the invoice images attached to them.

None of that is patient clinical data — that’s in the EHR — but a lot of it is regulated anyway.

The retention rules that apply

• HIPAA requires six-year retention of documentation under the Security and Privacy Rules (45 CFR 164.316 and 164.530): policies, access logs, risk assessments, and the like. If the ERP holds group-health-plan enrollment data, it’s PHI and the safeguards apply to the archive too.
• CMS requires providers filing cost reports to retain supporting records at least five years after the cost report is settled; Medicare Advantage and managed care organizations, ten years. The GL and payroll detail behind a cost report lives in the ERP.
• IRS and FLSA payroll rules (four years and three years respectively) are the floor; most health systems’ retention schedules set payroll at seven to ten years.
• State hospital licensing and records laws vary and frequently exceed all of the above.

The practical reading: keep everything for at least ten years, protect it as if it were PHI, and be able to produce it on request.

The three things that go wrong

The archive isn’t secured like the ERP was. In Lawson, HR security classes and process levels kept a clinic’s HR partner from seeing the hospital’s executive pay. A data lake export throws that away. In a health system with 15,000 employees, that’s a breach notification waiting for a curious analyst.

Attachments get dropped. Scanned invoices, signed offer letters, benefit election forms attached to ERP records are often not in the export. The first audit request for supporting documentation exposes the gap.

The old system never actually turns off. Because someone in payroll or supply chain still needs history and the archive can’t answer their questions, the Lawson environment stays up — still on the audit scope, still on the DR plan, still an unpatched system holding SSNs on the hospital network.

What the archive has to do

Reproduce the application, not just the tables: every record and attachment, searchable by the people who use history, with role-based access that mirrors the ERP’s, behind the hospital’s own SSO, in a cloud account the hospital controls, with a SOC 2 report to hand to the compliance office.

That’s how Mayo Clinic, Boston Medical Center, Broward Health, and The Christ Hospital handle retired ERP history with APIX: the full application archived into the health system’s own AWS account, SAML sign-on, security model reproduced, standard inquiries delivered, source system decommissioned. Load to decommission is about 30 days.

A note on the business case

A health system’s read-only Lawson environment typically costs $200K–$500K a year all-in — hosting, database licensing, an administrator’s time, and audit scope. An application archive costs a fraction of that, and the first year’s savings usually pay for the whole three-year term. Finance will not need convincing; they’ll need the number.

If you’re planning or in the middle of an ERP migration and want to work through the retention, security, and decommission plan for your legacy system, book a discovery session. We’ve done this for health systems from community hospitals to academic medical centers.