EHR Data Export 101 and What Your Old Vendor Owes Your Clinic

EHR data export is how your clinic gets every chart, note, and bill out of your old system so a new one can take over. If your EHR is certified by the federal government, your vendor already owes you a full copy of the patient data it stores.

A lot of practices learn this the hard way. On billing forums and review sites, office managers talk about losing their login credentials the day the contract ended, then getting a bill just to look at old charts. Others say the files showed up in a format their new EHR couldn’t open.

Therefore, i3n this blog, I stick to one job, which is helping you leave your EHR with every record and without paying fees you don’t owe. You’ll see what the rules promise, what they skip, how C-CDA, HL7, and FHIR compare, where to store old records safely, who does which job, and how to check your files before you cancel.

What a Certified EHR Owes You When You Leave

The promise starts with two kinds of exports. Certified EHRs must offer both under the federal export criterion, and each one helps you in a different way.

• Single patient export: Anyone on your team with permission can run it whenever they want, with no call to the vendor. You decide who gets that permission, either a short list of named staff or your system admin.
• Patient population export: This one pulls every patient in your system at once. The vendor runs it for you, so you’ll have to request it.

Both files must be ‘computable.’ That’s a fancy way of saying software can read each piece of data on its own, like a medication name or a lab value. Each export also comes with a public link that explains the file’s layout, and the vendor has to keep that page up to date.

The export covers everything the product could store when it got certified. So you’re owed a lot more than a short list of problems, medications, and allergies.

Want to know if your EHR is certified? 

Look it up on the CHPL listing, the government’s list of certified health software, and check that its record shows criterion 170.315(b)(10).

The population export is the file your whole switch depends on. So the next big question is what a vendor is allowed to charge for it.

Fees Your Vendor Can’t Charge When You Switch

For a certified EHR, the answer is clear. Federal information blocking rules let vendors charge for some data work, but that permission doesn’t cover a fee to run the certified export when you’re switching to new software, according to ONC guidance.

Older or uncertified systems have a rule too. A fee to export or convert your data isn’t protected unless you agreed to it in writing when you first bought the software. That’s why your original signed order form matters so much.

Some costs are still fair, so get prices for these before you give notice.

• Mapping and conversion work your new vendor does to load the files into its system, priced under your new contract.
• Read-only access to the old system after your contract ends, since it’s a separate service.

Knowing the rule helps most when a vendor drags its feet or sends a bill anyway.

What to Do When Your Vendor Pushes Back

A stalled export or a surprise bill has two separate paths for help, and you can use both.

• The first path is about certification. ONC asks you to start with the vendor itself. If that doesn’t work, contact the certification body that approved the product, which you’ll find on the product’s CHPL record. That body can review the problem, post any failures on CHPL, and require the vendor to follow a plan to fix them. If you’re still stuck, ONC takes complaints through its feedback portal.
• The second path is about information blocking. You can file a claim through the federal claim portal. Vendors that sell certified health IT can face civil money penalties of up to $1 million per violation, enforced by the HHS Office of Inspector General. People do use that portal. ONC’s own claims data counted 2,450 possible information blocking claims through July 31, 2026.

Save every email and quote along the way, since both paths work best with written proof. Once the file does arrive, the next thing to check is what’s inside it.

What Lands Inside the Export File

The file covers something called electronic health information, or EHI. Federal rules tie EHI to HIPAA’s designated record set, which covers a clinic’s medical records, billing records, and other records used to make decisions about patients. So claims history and payments belong in your export next to clinical notes.

Pictures count too. Any images your product could store when it got certified must come out in the export. That includes clinical photos and scanned records from other offices.

Two things are left out of the EHI definition.

• Psychotherapy notes, which HIPAA defines as a therapist’s session notes kept apart from the rest of the medical record.
• Information gathered for a lawsuit or another legal case.

Your clinic’s setup stays behind as well. Note templates, fee schedules, appointment types, and user permissions describe how your office runs, so you’ll rebuild them in the new system.

The rule also doesn’t require any particular file standard or a fixed list of fields. Each vendor picks its own layout, which is where C-CDA, HL7, and FHIR come in.

C-CDA vs HL7 vs FHIR During a Vendor Switch

These three names often pop up in vendor emails about switching. They’re cousins, so it helps to start with what they share.

What they have in common

• All three come from HL7 International, the nonprofit group that writes health data standards.
• All three can carry the same medical code lists, like LOINC for lab tests and RxNorm for medications. That way a blood sugar test can mean the same thing in every system.
• None of them is the same thing as your full export. The federal rule lets your old vendor pick its own layout for that.

How they differ

Standard	What the data looks like	How it moves	Best job in a switch
C-CDA	A structured XML document	One whole file per patient	Summaries for active patients
HL7 v2	Short text messages split by bar symbols	One event at a time	Live lab results and orders after go-live
FHIR	Small data pieces, usually JSON	Through an API, one patient or a whole group	Bulk loads of core clinical data
Certified EHI export	Whatever layout the vendor documents	One big delivery	Your full record of truth

How each one shapes your export

C-CDA documents and FHIR files are built around USCDI, a federal list of core data like problems, medications, allergies, lab results, vital signs, and clinical notes. Certified products now use USCDI version 3, which added things like health insurance details. That makes these files easy for a new EHR to load, but they still leave out billing ledgers and many custom fields.

HL7 v2 is built for daily feeds, so it isn’t meant to carry years of history. The certified EHI export holds everything, but in your old vendor’s own layout, so each field has to be mapped before the data becomes useful.

That’s why your request should ask for both. The certified population export gives you everything, and the C-CDA or FHIR files help your new system load active patients cleanly. Which mix makes the most sense depends on the kind of clinic you run.

Which Data Exchange Fits Your Type of Clinic

Your specialty, size, and the systems you connect to all change the right mix.

• Solo or small practice: The certified population export plus C-CDA files is often enough. Your live connections are often limited to a lab and a claims clearinghouse.
• Group or multi-specialty practice: Plan HL7 v2 interfaces for lab results and orders, so results keep flowing on day one. Ask both vendors who builds each interface and who tests it.
• Practice with many patients or app plans: FHIR bulk export moves core clinical data for whole groups of patients at once. Many certified EHRs also carry a standard FHIR API under criterion 170.315(g)(10), which helps patient apps connect later.
• Behavioral health practice: Plan a separate, secure way to move or store psychotherapy notes. Substance use treatment programs covered by 42 CFR Part 2 also have extra consent rules for sharing records.
• Imaging-heavy specialty: Dermatology, wound care, and orthopedic practices should ask how big the image files are, how they’ll be delivered, and how each image links back to the right chart.

Whatever mix you choose, the next decision is how much history to move and where the rest will live.

Migration Strategies and Where to Store Old Records

How much history you move decides your migration strategy. There are three common ways to do it.

1. Full conversion: Every chart moves into the new EHR. Your staff works in one place, but it takes the most mapping and testing.
2. Active patients plus an archive: Patients you see now move over, along with open balances and pending claims. Older charts stay in the raw certified export.
3. Archive only: You start fresh charts in the new EHR and keep the whole history in an archive. It’s the least work up front and the most lookups later.

Wherever old records land, HIPAA follows them. HHS doesn’t recognize private “HIPAA certified” labels, so being compliant comes down to the contract you sign and how you set things up. Here are the safe places clinics use.

• Inside your new EHR: Many EHRs can hold old files as attached documents in each chart. Ask how easy they’ll be to search.
• Cloud storage with a BAA: Any cloud company that stores your patient data counts as a business associate, even if the files are encrypted and it can’t read them, according to HHS cloud guidance. No signed BAA means no upload.
• An encrypted server in your office: This works if you control who can open it, keep a backup copy somewhere else, and include it in your HIPAA risk analysis.
• Read-only access from the old vendor: You keep the familiar screens, as long as your BAA covers every month you keep access.

Put the line between convert and archive in writing with your new vendor, so you both price the same amount of work. That agreement goes smoother when everyone knows which jobs are theirs.

Who Does What When You Switch EHRs

Three parties share the work, and each one owns different steps.

• Your clinic checks the files and signs off, keeps archived records for your state’s retention period, and answers patient record requests. ONC’s rules don’t require clinicians to use the export tool at all. Your clinic still counts as an “actor” under the information blocking rules, though, so patient record requests have to keep moving during the switch.
• Your old vendor carries the export duties covered above and holds your data under the BAA until it’s returned or destroyed.
• Your new vendor signs a BAA before it touches your data and handles the loading work you agree on.

Most of the old vendor’s duties get locked in by one document, which is the contract you already signed.

Contract Terms to Check Before You Give Notice

That contract sets your notice period, your auto-renewal date, and what happens to your data after the last day. Read it before you tell the vendor you’re leaving.

HIPAA doesn’t make a vendor keep your records after its service ends, according to HHS guidance. Your business associate agreement, the privacy contract your EHR vendor signs with you, must require the vendor to return or destroy your patient data when the contract ends, where that’s possible. So pull your full export well before that date, and ask in writing for your data to be returned.

The export rule doesn’t set a delivery method either. A large practice might get a secure download or an encrypted hard drive. Put these items in one written request and save the reply.

• Your product name and certification listing
• A full patient population export under 170.315(b)(10)
• The public link to the export format
• A delivery date and delivery method
• Written confirmation of no fee for the certified export
• The price and length of any read-only access
• A certificate of destruction only after you confirm you received everything

Even with the files in hand, you’re only halfway there. A folder can look complete and still be missing charts.

How to Validate Your EHR Data Export Before You Cancel

Missing charts show up when someone compares the old system with the new one, piece by piece. Do these checks while you can still log in.

1. Test a few patients early: Run the single patient export yourself, open the files, and compare them with the vendor’s format page.
2. Count before and after: Compare the totals for patients, visits, notes, scanned documents, lab results, and claims in both systems.
3. Spot-check the hard charts: Pick patients with long histories, lots of attachments, or recent visits, and read them side by side.
4. Check that the meaning held up: Make sure current and stopped medications kept their status, allergies kept their reactions, and lab values kept their units.
5. Practice a records request: Pull one archived chart from the raw export the way your front desk would for a patient, and time how long it takes.
6. Sign off in writing: List every gap, give each one an owner, and set a fix date before you cancel.

Signing off feels a lot safer when you know the rules behind your export won’t shift before your cancel date.

Final Thoughts: Where the HTI-5 Proposal Leaves Your Export Rights

Those rules are being reviewed right now. The federal HTI-5 proposal would remove 34 of the 60 certification criteria for health software, and the EHI export criterion isn’t one of them. At the time of writing it’s still only a proposal, and the fee rules above apply today.

The same proposal would drop one C-CDA performance criterion and update the criterion behind referral summaries. It also sets the stage for future FHIR requirements. Your contract and state law can add their own duties on top of these federal rules, so talk to a healthcare attorney if your vendor fights you on a fee or a deadline.

Your next EHR vendor handles the last stretch. Before you sign, ask them to read your old vendor’s export format page, map the fields, run test loads with you, and tell you in writing which data will come in as searchable fields and which will come in as attached documents.

If OmniMD is on your shortlist, bring that export format link to your demo and ask us these same questions about your own data.