Legacy Health in Portland, Ore., is reworking the infrastructure behind its Epic electronic health record after the virtualization software running the system was removed from Epic’s list of supported environments, forcing the health system to replatform one of its most critical applications. The move comes as the provider contends with aging infrastructure, rising cybersecurity threats and continued financial pressure, all while trying to keep clinical systems available for doctors, nurses and patients.
Why the change matters
For hospitals and health systems, the EHR is not just another application. It stores patient histories, drives orders, supports medication workflows and connects to labs, imaging and billing systems, which means any infrastructure change can quickly affect care delivery.
When a vendor no longer supports the platform underneath an EHR, IT teams lose a layer of operational protection. Support gaps can complicate troubleshooting, delay upgrades and increase the risk that a performance issue becomes a service outage.
The background behind the replatforming push
Legacy Health’s challenge reflects a broader pattern across healthcare IT. Many providers still run mission-critical software on systems that were built years ago, then layered with upgrades, virtual machines and custom configurations as clinical demands grew.
That approach can work for a time, but it also creates technical debt. As vendors update support policies, hospitals may find that software once considered stable no longer fits within approved environments, forcing IT teams to redesign infrastructure faster than planned.
In Legacy’s case, the work centered on the Epic database, the core data layer that helps keep records, transactions and clinical data flowing. Replatforming that component is a high-stakes task because it sits at the center of uptime, backup and recovery planning.
Cybersecurity and reliability are driving the shift
The infrastructure review is happening against a backdrop of growing cyber risk. Healthcare remains a top target for ransomware and other attacks because patient care depends on systems that cannot stay offline for long.
IBM’s 2024 Cost of a Data Breach Report said healthcare remained the most expensive industry for breaches, with an average cost of $9.77 million. That figure underscores why providers are scrutinizing the software stack beneath their EHRs as closely as the applications themselves.
Outage resilience is also part of the equation. The Uptime Institute’s 2024 Annual Outage Analysis found that most organizations experienced at least one significant outage in the prior three years, reinforcing the pressure on IT teams to build systems that can recover quickly and operate with less manual intervention.
For health systems, the business case is no longer limited to performance. Infrastructure decisions now affect clinical continuity, cyber resilience and compliance readiness at the same time.
What adaptable infrastructure looks like
Providers are increasingly looking for infrastructure that can support upgrades without major disruption. In practice, that can mean moving workloads to approved hardware, tightening standardization, improving backup design or redesigning environments so they can be replicated more quickly after an outage.
For an Epic environment, that flexibility matters because hospitals often need to coordinate database performance, storage throughput and disaster recovery plans across multiple sites. A replatforming project can also create an opportunity to reassess capacity, automate routine maintenance and simplify support.
Health systems are under pressure to do more with less, which makes predictable platforms attractive. The less time teams spend managing exceptions and unsupported configurations, the more time they can devote to patching, security monitoring and clinical support.
The operational stakes for providers
Changes to EHR infrastructure rarely happen in isolation. They usually require coordination among infrastructure teams, clinical informatics leaders, application owners and security staff, along with testing that verifies orders, charting, reporting and backup processes still work as expected.
That level of coordination matters because even a brief disruption can ripple across a hospital. Scheduling can stall, medication workflows can slow and clinicians may have to switch to downtime procedures, which increases the chance of delays and documentation gaps.
At the same time, keeping unsupported infrastructure in place can be even riskier. Providers can face higher maintenance costs, narrower vendor assistance and a more fragile security posture if the underlying platform falls out of alignment with official guidance.
What the Legacy Health case signals for the industry
Legacy Health’s move reflects a broader trend in healthcare IT: infrastructure is becoming a clinical asset, not just a back-office function. As EHRs grow more central to patient care, the systems beneath them must be easier to maintain, harder to break and faster to recover.
For readers, the practical takeaway is that the reliability of a hospital’s digital infrastructure increasingly shapes the care experience, even if patients never see the servers behind it. For providers, the lesson is that vendor support status, security posture and resilience planning now belong in the same conversation.
What to watch next is whether more health systems face similar replatforming decisions as vendors narrow support windows and cyber threats continue to rise. The next phase of modernization will likely focus on how quickly providers can move critical workloads onto supported, adaptable infrastructure without interrupting patient care.
Frequently Asked Questions
Why does it matter if the virtualization layer is no longer supported, even if Epic still appears to work normally?
Because support is part of the safety net behind the application. If the underlying platform is unsupported, troubleshooting gets harder, patches may not be certified, and vendor assistance can be limited during an outage or upgrade. In healthcare, that increases the chance that a small technical issue becomes a disruption to clinical operations.
What does ‘replatforming the Epic database’ actually involve?
It usually means moving the database and related services to a new, approved infrastructure stack rather than simply upgrading software in place. That can include new servers, storage, virtualization or operating systems, plus updated backup and recovery design. The goal is to keep the core data layer stable while reducing support and security risks.
Does this kind of infrastructure change affect doctors and nurses directly?
It can, but ideally only behind the scenes. The main risk is during migration, when performance, access or downtime issues could interfere with orders, charting or results review. Health systems typically plan these projects carefully to minimize disruption, because the EHR is tightly linked to everyday patient care workflows.
Is this mainly a cybersecurity project or an IT maintenance project?
It’s both. The move helps reduce operational risk from unsupported software, but it also supports cyber resilience by making patching, recovery and standardization easier. In healthcare, infrastructure decisions increasingly overlap with security because ransomware, outages and compliance obligations all depend on how reliable the underlying systems are.
Why would a health system take on a project like this during financial pressure?
Because delaying it can be more expensive later. Unsupported infrastructure can raise outage risk, complicate upgrades and increase the cost of recovery after a failure or cyberattack. For a hospital, protecting the EHR is not optional; it is a core operating requirement, so preventive investment can be the lower-risk choice.