Replacing a hospital network's scheduling core without stopping the clinics

A hospital network in the United States schedules every appointment, procedure room and clinician through a core system built two decades ago and extended by every team that has touched it since. Dozens of consumers depend on it: the electronic health record, the patient index, the billing system, the patient portal, the call centre, the operating-theatre planners and a set of interfaces nobody has documented. It works, most days, and nobody wants to be the person who turned it off.

The constraints are clinical and legal. Downtime is not an outage; it is a clinic that cannot see patients. Protected health information moves through every interface, so the HIPAA privacy and security rules govern the design of anything that replaces it, and the network's compliance office must sign the controls. A big-bang cut-over over a weekend would put both the clinics and the compliance office at risk at once.

The mandate is to replace the core without a cut-over: a compatibility layer that speaks the old system's contracts to every consumer, a new core built behind it, consumers moved one at a time with dual running and reconciliation, rehearsed rollback at every step, and the network's own engineers operating the pipeline at the end.