29.1 IT Selection, Acquisition & Maintenance

IT Selection, Acquisition & Maintenance

Quick Answer: FACHE leaders must know what drives selection of IT systems, how acquisition and contracting protect the organization, and how maintenance, upgrades, conversions, and technology lifecycles sustain value. The Board of Governors outline expects executives who resource and govern systems across their full life—not only champion a go-live date.

Healthcare Technology and Information Management items on selection and maintenance often present a rushed vendor choice, an underfunded upgrade, or a legacy system past vendor support. Strong answers treat IT as a capital and operating program with clinical, financial, and risk consequences. Weak answers treat selection as a demo contest or maintenance as an invisible IT back-office chore.

Why Selection Is an Executive Decision

IT systems shape how clinicians document, how revenue is captured, how patients access care, and how leaders see performance. Choosing poorly locks the organization into years of workarounds, interface cost, and staff frustration. Choosing well without funding optimization still fails. Selection therefore sits at the intersection of strategy, operations, finance, quality, and cybersecurity.

Typical selection triggers include:

• Strategic growth (new service lines, ambulatory network, hospital-at-home)
• Regulatory or payment program requirements (certified EHR, quality reporting, interoperability)
• End-of-life vendor support or unacceptable security risk
• Merger/affiliation requiring platform consolidation
• Chronic operational failure (throughput, denials, documentation burden)
• Clinical safety or quality gaps that technology can address when paired with process redesign

Executives should require a problem statement and success metrics before a product shortlist. “We need a new module because a competitor has one” is not a business case.

Factors That Influence Selection

Selection criteria should be explicit, weighted, and applied consistently. Common factors:

Best-of-breed vs. enterprise suite is a recurring trade-off. Suites can simplify support and integration; best-of-breed may excel in a specialty. Either path requires a funded integration and ownership plan. FACHE scenarios often punish leaders who approve a stand-alone tool without interface budget, clinical champion, or analytics definitions.

Acquisition Process and Contracting

Acquisition is more than signing a quote. Disciplined organizations use stages such as:

1. Needs assessment and requirements — clinical, operational, technical, regulatory
2. Market scan / RFI — understand options without premature commitment
3. RFP and demos — scripted scenarios from real workflows, not vendor slide decks alone
4. Reference checks and site visits — peers of similar size and complexity
5. Security, legal, and privacy review — parallel to functional scoring
6. Total cost and value model — multi-year TCO, benefits, risks, sensitivity analysis
7. Negotiation and award — price, SLAs, remedies, data rights, exit, upgrade path
8. Implementation governance — steering committee, scope control, readiness gates

Contract terms executives should insist on understanding (with counsel and CIO/CISO input):

• Scope of licenses and users — named vs. concurrent; affiliate expansion; telehealth volumes
• Service levels — uptime, response times, credits, escalation
• Implementation responsibilities — who owns data conversion, interfaces, training, testing
• Data ownership and portability — formats, timelines, fees on termination
• Security obligations and breach cooperation — notice, forensics, liability allocation
• Business associate agreement (BAA) where ePHI is involved
• Price protection and renewal caps — avoid surprise escalation after lock-in
• Audit rights and transparency — usage metrics, performance reports
• Subcontractor and cloud residency — where data lives and who touches it

Underfunding implementation and first-year optimization is a classic failure mode. Capital committees that fund software but not training, super-users, interface monitoring, or downtime procedures buy a license, not a capability.

Upgrades and Conversions

Upgrades keep a current platform current: major version releases, regulatory content updates, security patches, and module enhancements. Conversions (migrations) move from one system or major architecture to another—EHR replacement, cloud migration, archive of legacy data, or consolidation after merger.

Upgrade readiness factors:

• Vendor end-of-support dates and security bulletin criticality
• Regulatory content (coding, quality measures, e-prescribing rules)
• Interface and custom code impact—customizations often break first
• Training delta for clinicians and revenue-cycle staff
• Testing environments and regression test capacity
• Timing relative to peak census, surveys, fiscal close, or flu season

Conversion readiness factors:

• Data mapping quality (identity, allergies, meds, problems, historical results)
• Dual-system period risks (wrong chart, incomplete med lists)
• Cutover vs. phased strategies and command-center staffing
• Legal/medical-record retention and archive access for closed systems
• Revenue-cycle continuity (claims holds, coding, charge capture)
• Explicit success criteria and rollback/contingency plans

Executives should treat major upgrades and conversions as operational events, not pure IT projects. Clinical leaders, HIM, revenue cycle, and communication teams belong on the steering structure. “IT will handle it over a weekend” is a red flag for multi-hospital platforms.

Technology Lifecycles

Every system and device class moves through a lifecycle:

Lifecycle mismanagement creates technical debt: unsupported operating systems, unpatched medical devices, brittle interfaces, and skill shortages for obsolete platforms. Boards should see multi-year application portfolio roadmaps—what will be optimized, replaced, or retired—linked to capital and cyber risk, not only new shiny projects.

Hardware (workstations, scanners, servers, network gear), clinical devices with software, and cloud subscriptions all have refresh cycles. Deferred refresh can cost more than planned replacement when emergency purchases collide with ransomware exposure or downtime.

Maintenance as Ongoing Operations

Maintenance is the continuous work that keeps systems safe and useful:

• Preventive — patching, database maintenance, certificate renewal, capacity planning
• Corrective — incident response, defect fixes, interface failures
• Adaptive — configuration for new services, order sets, payer rules
• Perfective — usability improvements, report development, workflow optimization
• User support — help desk tiers, clinical informatics on-call, super-user networks

Service management practices (incident, problem, change, release) protect production environments. Change control that is too loose causes outages; change control that is too rigid blocks urgent safety fixes. Executives set the expectation that production change has owners, testing, and communication—including downtime windows coordinated with clinical operations.

Key performance indicators for maintenance maturity include critical patch latency, mean time to restore, backlog of enhancement requests by priority, user satisfaction, interface error rates, and percent of systems within supported versions.

Governance Model for Selection Through Lifecycle

A practical executive model:

1. Demand management — intake and prioritization against strategy and capacity
2. Architecture and security standards — preferred platforms, identity, integration patterns
3. Investment committee — capital/operating decisions with TCO and risk
4. Project governance — scope, risk, benefits realization, clinical readiness
5. Operations governance — uptime, optimization backlog, vendor performance reviews
6. Sunset discipline — funded decommission and data retention plans

Clinical informatics leaders (CMIO/CNIO where present), privacy/security, finance, and operational owners should share accountability. Vendors do not own strategy; they deliver products under contract.

Pitfalls FACHE Leaders Avoid

• Selecting on feature checklists or free dinner demos without scripted workflow scoring
• Ignoring TCO: interfaces, training, analytics, cyber, and upgrade years two through five
• Approving acquisition without BAA, exit clauses, or data portability
• Underfunding conversion quality and dual-system risk mitigation
• Skipping lifecycle replacement until a security incident or vendor shutdown forces crisis spend
• Treating maintenance as optional overhead while demanding 24/7 clinical reliability
• Customizing so heavily that upgrades become unaffordable
• Failing to engage physicians, nurses, and revenue-cycle staff until after contract signature

Executive Decision Lens

When a selection, upgrade, or conversion proposal reaches the C-suite or board, FACHE leaders ask: What operational or strategic problem does this solve, and how will we measure success? What is multi-year TCO and residual risk if we wait? How do security, interoperability, and data exit work? Who owns clinical workflow and benefits realization after go-live? What else must pause so change capacity is real? Selection chooses a partner and a path; acquisition locks commitments; maintenance and lifecycle management determine whether patients and staff actually benefit for the next decade.