Modernizing a Hospital EHR Without Downtime

A single VB/SQL monolith handled scheduling, charting, billing, and lab orders for 12 hospitals. Releases required 4-hour weekend windows, integration tests took two days, and HL7 interfaces were copy-pasted across departments. The board mandated zero clinical downtime during the migration.

A façade in front of the monolith routes traffic to legacy or new services based on feature flags. Domain services are extracted one bounded context at a time (scheduling first, then labs, then billing). An HL7/FHIR translation layer keeps both worlds speaking the same language until the cutover is complete. PHI is encrypted at rest with per-tenant keys.

┌──────────┐    ┌──────────────┐
│ Clients  │───▶│  Façade /    │
└──────────┘    │  Feature Flg │
                └──┬────────┬──┘
              old  │        │  new
                   ▼        ▼
            ┌──────────┐  ┌────────────────┐
            │ Monolith │  │ Domain Service │
            │  (EHR)   │  │ (Scheduling…)  │
            └────┬─────┘  └────────┬───────┘
                 ▼                 ▼
            ┌─────────────────────────────┐
            │  HL7 / FHIR Translation     │
            └─────────────────────────────┘

1. 01

   Strangler-fig migration, one bounded context per quarter, never two in flight.

2. 02

   Shadow traffic in production for 4 weeks per service before cutover.

3. 03

   PHI access audited end-to-end; break-glass flows require dual approval.

4. 04

   Rollback rehearsed on every release; cutovers always reversible within 5 minutes.