A legacy data migration can leave compliance gaps that only come to light months later, when an auditor asks for a record the new system doesn’t have.
The cause is usually something ordinary, like a box of paper left off the inventory, a microfilm reel nobody converted, or a file that picked up its scan date in place of the date it was created. Those records still carry their retention periods, and they’re still yours to account for after the old system is gone.
A plan written before anything moves prevents most of these gaps. This guide covers the paper, microfilm, and aging digital records that IT-focused migration guides tend to skip, from the first inventory to the final sign-off on the originals.
Why You Need a Data Migration Plan
A legacy record is any record you’re still required to keep that sits in a format or system you’re leaving behind. That includes paper files, microfilm and microfiche, and digital records stuck in software nobody supports anymore.
Moving a record doesn’t change your obligation to keep it. A personnel file with five years left on its retention clock still has five years left after a provider scans it, and it has to arrive complete, readable, and findable.
A data migration plan puts that obligation in writing. At minimum, it should name:
- one owner for the migration, plus the people who sign off on it
- every record series in scope, with its retention period and whether it’s under a legal hold, a freeze on disposal for records tied to litigation or an investigation
- what happens to each series: migrate it, keep it in its current format, or destroy it at the end of retention
- the chain of custody, meaning the documented record of who handled each box or file, when, and where
- how you’ll prove the new system holds everything the old one did
- when source records can go, and who approves their destruction
Records management or compliance usually owns the project. IT runs the technical move, and legal approves holds and disposal. If nobody has reviewed your retention schedule in a while, check it against current retention periods and requirements before the inventory starts.
Auditing Legacy Files Before Document Migration
Inventory comes first. Go through the file rooms, the offsite boxes, the film cabinets, and the shared drives, and list every record series with its date range, format, location, and owner.
Then hold each series up against your retention schedule. Record retention guidelines by state vary widely, and some federal rules leave the question to the states. The Department of Health and Human Services (HHS) notes in its FAQ on medical record retention that the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule sets no retention period for medical records, so state law generally governs how long they’re kept.
Expect this review to sort your records three ways. Active records with long retention go into the document migration, and inactive records can often stay in their current format until their clock runs out.
Records past retention with no hold are candidates for disposal. Migrating them costs money and extends your exposure, so deciding which paper files to keep and which to shred is a job for the inventory stage.
Microfilm needs its own line. Older acetate-base film can deteriorate (archivists call it vinegar syndrome, after the smell), so check its condition before you decide whether to convert it or keep it in climate-controlled tape and microfilm storage.
Closing Records Migration Compliance Gaps
Compliance gaps during a records migration tend to open in three places: legal holds, dates, and access.
Holds come first. In federal cases, the duty to preserve generally begins once litigation is reasonably foreseeable, so a hold can cover records nobody has asked for yet. You can still migrate held records, as long as nobody thins them out, alters them, or destroys them along the way.
Under Federal Rule of Civil Procedure 37(e), if electronically stored information is lost because a party didn’t take reasonable steps to preserve it, and it can’t be restored or replaced, a court can order measures to cure the harm to the other side. If the court finds the party meant to deprive the other side of that information, it can go as far as dismissing the case or entering a default judgment. Have legal confirm the hold list before the inventory is final, and keep held records out of every destruction batch.
Original dates can get lost in the move. If conversion stamps every file with the scan date, the new system may count retention from the wrong starting point, and the audit trail loses the original creation dates. Ask your provider to capture those dates as index fields, the searchable labels attached to each scanned file, then spot-check a sample yourself.
Access is the last of the three. Records that sat in a locked file room or a restricted folder need the same restriction after the move, backed by the same physical, digital, and internal-access security. Once a provider digitizes your records, a document management system can carry those permissions forward, and many systems add retention rules and a log of who opened what.
Chain of Custody in Your Data Migration Plan
During a migration, boxes leave the building, so the custody record has to travel with them. It should cover every handoff, from the moment a box comes off the shelf until you’ve confirmed its contents in the new system.
Providers in our network typically document each handoff with box-level barcodes, signed transfer manifests, and time and date stamps, and they move boxes in sealed, GPS-tracked transport. Ask for those logs as a deliverable, because an auditor will want to see them. If any originals go into storage afterward, those logs become the first entries in the chain of custody for stored documents.
When you retire the legacy servers and drives, plan how you’ll make their data unrecoverable. NIST Special Publication 800-88 Rev. 2, the National Institute of Standards and Technology’s media sanitization guidelines, replaced Rev. 1 in September 2025 and asks for a documented, organization-wide sanitization program.
Records Migration Compliance Starts Now
Proof comes from reconciliation. Count what goes in (boxes, folders, and estimated pages per series), then count what comes out of each batch, and investigate every difference before anyone signs off.
On top of the counts, pull a sample from each batch and compare the scan to the paper, checking that every page is present, legible, and indexed to the right series and date. The reconciliation report belongs with the chain-of-custody logs, and together they’re your answer when someone asks how you know the migration was complete.
Disposing of Originals After Sign-Off
Keep the originals until validation is finished and legal has cleared the disposal list. In the meantime, a provider’s offsite records storage keeps them retrievable without crowding your office.
Federal agencies offer a useful benchmark, even though their rules don’t bind private organizations. Under General Records Schedule (GRS) 4.5, the National Archives and Records Administration (NARA) schedule for digitized source records, agencies may destroy the originals only after validating that the digitization meets NARA’s standards. They also have to account for legal restrictions, such as a litigation hold, before any originals go.
Health information carries its own rules. HHS guidance on disposing of protected health information says covered entities (the health plans, clearinghouses, and health care providers HIPAA applies to) can’t simply abandon it or leave it in a dumpster the public can reach. It lists shredding, burning, pulping, and pulverizing among the ways to make paper records unreadable.
Write that final step into your document retention and destruction policy. When the paper goes, use a certified destruction provider and ask for a certificate of destruction for your files.
Choosing a Document Migration Partner You Can Trust
Match credentials to each stage of the job. The International Secure Information Governance & Management Association (i-SIGMA) issues two of the most relevant ones.
PRISM Privacy+ is i-SIGMA’s certification for records and information management, covering storage and hard-copy handling, and providers that digitize records can add an imaging and digitization endorsement to it. NAID AAA is i-SIGMA’s certification for secure destruction, while ISO 9001 is the international standard for quality management.
Record Nations is an i-SIGMA member, and we work closely with i-SIGMA to ensure our network providers meet the standards it sets for PRISM Privacy+ and NAID AAA certification. Before you sign with any provider, ask:
- Will original dates and retention categories be captured as index fields?
- What sample do you check from each batch, and will I get the reconciliation report?
- How do you keep records under hold separate from everything else?
- What chain-of-custody records come with each transfer?
- What format will the files arrive in, and will my new system accept them without re-indexing?
Each sector adds its own questions. A practice migrating medical records has to carry HIPAA safeguards through every handoff, while a law firm’s legal records often include active matters under hold. Providers in our network handle legacy conversions for both, in cities like Salt Lake City, UT, and Omaha, NE.
Legacy Data Migration FAQ
Yes, as long as the hold travels with them. The records have to arrive unaltered, stay out of every destruction batch, and remain easy for legal to find. Confirm the hold list with counsel before the inventory closes.
One named person, usually the records manager or compliance lead. IT owns the technical transfer and legal approves holds and disposal, but a single owner keeps the plan, the logs, and the sign-offs in one place.
At minimum, legal should approve the hold list, the retention mapping for each record series, and the final disposal list. Many organizations also have counsel approve the validation method, since it’s the evidence that the new system is complete.
No. Records past retention with no hold usually cost less to destroy than to convert, and inactive records near the end of retention can often stay in their current format until disposal. Migrating everything raises the cost and keeps records around longer than any retention rule requires.
After you’ve validated the migration, legal has signed off, and no hold or retention requirement still applies to the originals. Some originals are worth keeping regardless, such as records whose legal or historical value depends on the physical document.
How We Connect You With Conversion Providers
Record Nations connects you with certified, vetted providers who can handle the conversion, indexing, and chain-of-custody documentation that records migration compliance depends on. Tell us what’s in scope, from file rooms to microfilm cabinets, and we’ll help you get free quotes from document scanning providers near you.
Fill out our form or call (866) 385-3706 to talk through the project. Compliance-sensitive migrations are easiest to scope on a call, where you can walk through holds, retention periods, and timing before a single box moves.
