My Take On Retention of Legacy PHI

One of the most overlooked cybersecurity risks in healthcare is legacy data.

Organizations often retain years—or decades—of patient information long after it serves any operational, clinical, legal, or regulatory purpose. Every unnecessary record becomes another asset that must be secured, monitored, and defended.

The recent One Medical incident highlights this challenge. According to public reports, the company disclosed unauthorized access to a third-party storage system containing archived records from legacy Iora Health patients.

Data minimization isn't just a compliance principle—it's a security strategy.

Healthcare organizations should continuously evaluate whether legacy data can be securely disposed of, de-identified, or archived in a manner that reduces risk. If data no longer provides business, clinical, or legal value, retaining it may simply increase the organization's attack surface.

The safest data is often the data you no longer keep.