Migrating Off a Legacy Occupational Health System: A Data Migration Checklist

Most software migrations are an IT problem. Lose a few contact records when you swap marketing tools and someone re-enters them by lunch. An occupational health system migration is a different animal, and the difference is legal. The records sitting in your old system are, in many cases, documents you are federally required to keep for the length of someone's career plus three decades. "We lost some data during the switch" is not an apology your compliance officer can offer OSHA.

That single fact should shape how you plan the whole project. Treat the migration as a compliance exercise first and a technical one second, and the rest of the planning falls into place.

Why occ-health migrations are higher-stakes

Employee medical records must be preserved for the duration of employment plus 30 years (29 CFR 1910.1020(d)(1)(i)). Exposure records carry the same 30-year clock (1910.1020(d)(1)(ii)). A nurse hired in 1998 who leaves in 2025 has records you must still be able to produce in 2055. When you move platforms, every one of those records has to arrive intact, complete, and retrievable—because the retention obligation follows the record, not the vendor.

There are narrow exceptions: employees who worked less than a year (if their records were handed to them at termination), health insurance claim records kept separate from your medical program, and one-time first-aid records kept outside the program (1910.1020(d)(1)(i)). For a hospital or clinic, those exceptions cover very little. Assume almost everything moves.

What data needs to move

Start with an inventory of record classes and the statutory clock on each. This table is the most useful artifact you'll build in the whole project—print it, and check every item off as it lands in the new system.

A few things practitioners routinely underestimate. Bloodborne-pathogen medical records aren't just a line item—they include hepatitis B vaccination status and dates, examination results and follow-up procedures, and the healthcare professional's written opinion (1910.1030(h)(1)(ii)). Those are often stored as attachments, and attachments are exactly what falls through the cracks in a naive export. Fit-test records have an unusual clock: they only need to be kept until the next test (1910.134(m)(2)(ii)), so if your migration coincides with an annual fit-test campaign, coordinate the timing so you aren't moving records you're about to supersede.

If you are switching occ health vendors mid-year, this inventory is also your negotiating leverage: it tells you exactly what the outgoing vendor is obligated to hand back and in what shape.

Planning the migration

Before a single row moves, do the groundwork.

Inventory and map your fields. Walk the old system module by module and list every field, then map each to a destination field in the new platform. This is where you discover the legacy system stored "date of birth" as free text or crammed two phone numbers into one column. Better to find that now than during validation.

Flag what's still inside its retention window. You are not obligated to migrate records whose clock has fully run—but be conservative. When in doubt, move it. Deleting a record you turn out to still need is the one mistake you cannot walk back.

Confirm the export format in writing. Get your outgoing vendor to commit—ideally in the contract—to a usable, non-proprietary export (CSV, standard XML, or an equivalent) with attachments included. A PDF dump of screens is not a migration; it's a filing cabinet you can't query. If the vendor can only produce a proprietary blob, budget time to reverse-engineer it.

Handle PHI correctly during the move. Everything you're moving is protected health information. Any third party touching that data mid-migration—including the new vendor's implementation team—needs a business associate agreement in place before the first file transfers. Don't let a helpful engineer pull a "quick sample export" to a personal laptop; that's a breach waiting to be reported.

Plan the rollback and the parallel run. Keep the legacy system live and read-only through go-live and for a defined period after. If validation surfaces a problem in week three, you want the source of truth still standing.

One item that's easy to miss: if the migration is part of shutting a facility or business down entirely rather than just switching tools, the transfer-of-records rules in 1910.1020(h) may apply, including notifying NIOSH before any records are disposed of. Confirm the exact text with counsel if that's your situation.

Validating migrated records

Migrating employee health records isn't done when the import finishes. It's done when you've proven the import is complete and correct.

1. Reconcile record counts. Pull counts by record type from the old system and the new one, and account for every difference. "We migrated 12,400 immunization records and the new system shows 12,400" is a good morning.
2. Spot-check encrypted and PII fields. Open a sample of records and confirm SSN, date of birth, and contact fields decrypted and landed correctly—not shifted a column, not truncated, not showing ciphertext.
3. Check clinical narratives for truncation. Long free-text fields (301 incident descriptions, provider notes) are a classic casualty of import character limits. Verify the longest ones survived whole.
4. Confirm attachments transferred. Signed consents, audiograms, fit-test forms, written medical opinions—open several of each and make sure the file, not just a broken link, came across.
5. Preserve edit history on OSHA logs. OSHA 300 Logs must be updated throughout their five-year retention to add newly discovered cases and reflect reclassifications (1904.33(b)). Your new system needs to hold that history, and you should verify a case that was reclassified in the old system still reads correctly in the new one.
6. Sign off formally. Produce a migration audit record—who ran it, when, counts reconciled, samples verified—and keep it. If a record's integrity is ever questioned years from now, that document is your evidence.

A platform built for this—carefoundryESC among them—encrypts PII at rest and audit-logs record changes, which makes both the spot-checks and the sign-off far less painful than reconstructing a paper trail after the fact.

How long does it take?

There's no honest one-number answer, and be wary of any vendor who gives you one. Duration is driven by three things: the volume of records, the number of distinct record types, and—by far the biggest variable—how much cleanup the legacy data needs. A tidy single-clinic dataset with clean field mapping is a different project from twenty years of merged facilities with inconsistent codes. Build in real time for a dry run, full validation, and a parallel run; those phases are where quality is won. Skip them and the problems surface months later, when they are far harder to trace and fix.

Time it around one hard deadline: OSHA's electronic submission under 1904.41 is due March 2 each year for covered establishments. Don't schedule go-live in a way that jeopardizes your ability to file.

FAQ

What's the single most important record class to protect during a migration? Employee medical and exposure records, because of the employment-plus-30-year and 30-year retention clocks (1910.1020(d)(1)). Losing OSHA 300 data is serious, but those logs age out in five years; medical records can outlive the employee's entire career.

Can I archive old data instead of migrating it? You can, if it's still retrievable and produced on request. But a proprietary archive from a vendor you're leaving is a bet that you'll still be able to open it decades from now. Migrating into an active, supported system is safer for anything inside its retention window.

What are the stakes if records go missing? OSHA recordkeeping failures carry civil penalties—the maximums in effect since January 15, 2026 run to $16,550 per serious violation and $165,514 per willful or repeated violation (OSHA penalties). OSHA re-indexes these for inflation every January, so confirm the current figure at filing time. The harder cost is not being able to produce an exposure record when a former employee's health claim depends on it.

Migration is one of the few moments where you get to inspect every record you own. Use it. If you're mapping out a switch and want a checklist tied to the specific record types your facility keeps, the carefoundryESC team is happy to walk through it with you—no obligation to switch anything.