Scope
This guide focuses on the security controls and procedures needed when your organization acquires electronic health record systems. It covers legacy server management, credential security, migration oversight, and zero-trust implementation for unmigrated environments. If you're managing healthcare IT during or after a merger, use this as your reference for treating inherited systems as high-risk assets until they're secured or decommissioned.
Key Concepts and Definitions
Unmigrated Environment: Any server, database, or application holding protected health information not yet moved to your secure perimeter. These systems retain full operational risk even when marked "legacy" in inventories.
Data-Lifecycle Failure: A security gap created when data is migrated to a new platform without immediately securing or purging the source copy. Both instances then require production-grade controls.
Zero-Trust Enclave: A network segment where every access request requires new authentication and authorization, regardless of the requestor's location or prior access history.
Mission-Critical Classification: A security designation that subjects a system to the same uptime, monitoring, and access controls as life-safety biomedical devices. For EHR systems, this means treating patient records with the same criticality as infusion pumps or ventilators.
Requirements Breakdown
Credential Security
Multi-Factor Authentication (MFA)
Enforce MFA on every account with access to unmigrated servers. Single-factor credentials were the entry point in the Oracle Health incident, where attackers used compromised customer credentials to access older Cerner servers.
Credential Rotation
Rotate all service accounts and administrative credentials within 24 hours of acquisition close. Don't assume the seller's credential hygiene matches yours.
Access Provisioning Review
Audit every account with access to inherited systems. Deprovision accounts belonging to departed employees, contractors, or vendor personnel no longer under contract.
Network Isolation
Segmentation Requirement
Place all unmigrated systems in isolated network segments with explicit deny-by-default firewall rules. Allow only documented, business-justified connections.
Lateral Movement Prevention
Block network paths between unmigrated environments and your production EHR systems. Attackers who compromise a legacy server shouldn't be able to pivot to current clinical systems.
Logging and Monitoring
Centralized Log Collection
Forward all authentication attempts, file access events, and administrative actions from unmigrated servers to your central SIEM. You can't investigate what you didn't log.
Alerting Thresholds
Configure alerts for:
- Failed authentication attempts (threshold: 5 within 10 minutes)
- Off-hours administrative access
- Bulk data export operations
- New outbound network connections
Migration Oversight
Deletion Verification
After migrating data to your production environment, cryptographically erase the source copy and document the deletion. "Legacy" servers holding patient data remain attractive targets until they're empty.
Migration Timeline
Establish a hard deadline for completing data migration. Every day an unmigrated system holds patient records is a day it requires production-grade security controls.
Implementation Guidance
Immediate Actions (First 30 Days)
Inventory inherited systems: Document every server, database, and application that came with the acquisition. Note which systems hold protected health information.
Enforce MFA: Enable multi-factor authentication on all administrative and service accounts. No exceptions for "temporary" or "soon-to-be-migrated" systems.
Review access logs: Pull 90 days of authentication logs from inherited systems. Look for unfamiliar accounts, off-hours access, or access patterns that don't match documented business processes.
Implement network isolation: Move unmigrated systems to dedicated VLANs with restrictive firewall rules. Default deny, explicit allow.
Ongoing Controls (Until Migration Complete)
Treat unmigrated environments as untrusted enclaves: Apply the same security rigor you'd apply to a third-party vendor's system. Don't relax controls just because you own the hardware.
Monthly access reviews: Audit who accessed unmigrated systems and why. Revoke access for anyone who doesn't have a current business justification.
Vulnerability scanning: Run authenticated scans against unmigrated systems weekly. Patch critical vulnerabilities within 72 hours or isolate the affected system until patching is complete.
Incident response preparation: Update your breach response plan to account for compromises in unmigrated environments. Include patient notification procedures, extortion response protocols, and forensic preservation steps.
Common Pitfalls
Assuming "legacy" means "low-value": The age of a system doesn't determine the value of its data. Unmigrated servers holding Social Security numbers and medical histories present the same breach risk as your production EHR.
Delaying security controls until after migration: If a system holds patient data today, it needs production-grade security today. Migration timelines slip; breaches don't wait.
Trusting inherited credentials: Don't assume the acquired organization's credential management matched your standards. Rotate everything and enforce MFA immediately.
Treating migration servers differently than production: Attackers target the copy you've stopped watching. If you wouldn't accept a security gap in production, don't accept it in an unmigrated environment.
Skipping deletion verification: Moving data to a new platform doesn't remove the old copy. Until you've cryptographically erased the source and documented the deletion, you're securing two copies instead of one.
Quick Reference Table
| Control Domain | Minimum Requirement | Verification Method |
|---|---|---|
| Authentication | MFA on all accounts with PHI access | Review authentication logs for single-factor logins |
| Network Access | Isolated VLAN with deny-by-default rules | Test lateral movement paths from unmigrated systems |
| Logging | All auth, access, and admin events to central SIEM | Verify log forwarding and alert functionality |
| Vulnerability Management | Authenticated scans weekly; critical patches within 72 hours | Review scan results and patch deployment logs |
| Access Review | Monthly audit of all accounts with system access | Document review findings and access revocations |
| Data Purging | Cryptographic erasure within 30 days of migration completion | Retain deletion certificates and verification reports |
| Incident Response | Updated breach procedures covering unmigrated systems | Test response plan with tabletop exercise |
Your merger agreement closed months ago, but your security obligations for inherited systems don't expire until those systems are properly secured or the data they hold is verifiably deleted. Every unmigrated server holding patient records is a production system until it's empty.
