A telehealth data export checklist is the starting point for any future healthcare data migration. It should specify which records you can retrieve, their format, their relationships, and the conditions for receiving them. A promise that “your data is yours” does not establish whether another platform can use the export or whether your team may access every clinical record.
For US telehealth operators, separate commercial access rights from medical-record custody and privacy obligations. The goal is usable, authorized portability, not an unrestricted copy of everything in the system.
Map the records before discussing file formats
Begin with the workflows you need to preserve. A patient profile may connect to intake responses, clinical encounters, prescriptions, orders, invoices, support messages, and consent records. An export that loses those connections can be difficult to use even when every file opens successfully.
Ask the vendor for a data dictionary explaining each field, its possible values, and the stable identifiers used to link records. Request a small synthetic sample early in procurement.
| Record group | What to request | Acceptance question |
|---|---|---|
| Patient accounts | IDs, contact fields, status history | Can records be matched without guesswork? |
| Intake and consent | Answers, question versions, timestamps | Can we reconstruct what was presented? |
| Clinical records | Authorized notes and attachments | Can the responsible clinical team read the history? |
| Prescriptions and orders | References, status, destination, dates | Can open work be distinguished from completed work? |
| Billing | Invoices, adjustments, subscription references | Can balances and future charges be reconciled? |
| Audit history | Relevant access and change records | Can important actions be traced? |
Some fields may be restricted by role, law, or agreement. Record those restrictions rather than treating an unavailable field as an unexplained technical problem.
Specify formats and relationships that support EHR data migration
Structured exports such as CSV or JSON can support analysis and imports. Human-readable documents may be necessary for reviewing notes or attachments. Neither format is universally sufficient on its own.
Ask for timestamps with time zones, original record identifiers, attachment references, and a description of deleted or archived records. Confirm how corrected entries and historical versions are represented. A current value without its history may not answer the question your clinical or finance team needs to investigate.
Use the platform RFP template to make these requirements part of vendor selection. Testing portability after a termination notice leaves less room to resolve disagreements.
Separate medical records from business reporting
The entity providing clinical care may have responsibilities for the medical record that differ from the brand’s access to orders or revenue reports. Identify who authorizes disclosure, who responds to patient requests, and who remains responsible for retained records after a platform change.
HHS business associate contract guidance addresses return or destruction of protected health information at termination when feasible, with continued protections where that is not feasible. It does not turn every termination into an instruction to delete all clinical records immediately.
Also avoid using “HIPAA requires six years” as a blanket medical-record retention rule. HHS states that the HIPAA Privacy Rule does not itself establish medical-record retention periods. Applicable state rules and other obligations need separate review.
Treat payment portability as a separate project
A billing export may contain processor customer IDs and token references. Those references do not necessarily provide a working payment method in another account. Record the processor-led transfer process, supported data types, and required permissions separately.
The subscription migration guide explains why patient data, payment data, and renewal schedules need coordinated workstreams. Do not place raw card data in a general-purpose export request.
Similarly, exporting prescription history does not automatically transfer a prescription or establish a new clinical relationship. Use the active-prescription migration guide to plan those responsibilities.
Run a practical export acceptance test
Choose synthetic cases that contain more than a name and email. Include a corrected intake answer, two encounters, an attachment, a partial refund, and an unresolved order. Ask the vendor to export them using the process that would be available to your team.
Verify that:
- Counts match the agreed scope of the source records.
- Required fields contain meaningful values.
- Parent and child records remain linked.
- Documents and attachments can be opened.
- Time zones and status definitions are documented.
- The receiving team can explain unresolved cases from the export.
Keep a discrepancy log with an owner and resolution date. A screenshot of an export button is not evidence that the exported information is complete or usable.
Put delivery terms in writing
Specify who can request exports, how requests are authenticated, expected delivery time, fees, frequency limits, and access during a dispute or transition. Clarify whether a final incremental export is available after the initial copy.
Preserve reporting definitions too. The telehealth funnel metrics guide shows how event meaning affects analysis. A new platform can contain the same records yet report different results if its definitions change.
Frequently asked questions
Is a CSV export enough?
Only if it contains the required fields and relationships for your use case. Clinical documents, attachments, and audit history may need additional formats or files.
Should we request exports before we plan to leave?
Yes. A routine portability test helps establish whether the contractual promise works in practice and makes future reporting or migration planning more reliable.
Does data ownership guarantee unrestricted access?
No. Access depends on the record type, authorized role, applicable obligations, and agreement. Ask for specific rights and delivery mechanics instead of relying on a broad slogan.
