Replacing Legacy Preservation Storage in a HIPAA-Regulated Repository

Historical Collections and Services at the University of Virginia’s (UVA) Claude Moore Health relied on a legacy Network-Attached Storage (NAS) system implemented under prior leadership. When we were alerted that the system was outdated and experiencing bitrot, it posed both preservation risk and compliance concerns for digital collections containing Protected Health Information (PHI). The repository communicated the risk to library IT and defined a primary requirement: replacement storage and workflows must meet HIPAA and UVA Health security standards. In response, a new environment was developed that centered on a new Direct-Attached Storage (DAS) and a dedicated workstation capable of switching between the library IT environment and the hospital IT environment with the touch of a button. Institutional cloud storage was adopted for HIPAA- and health-system-compliant storage and collaboration, and migration from the legacy NAS to the new DAS is currently underway. This lighting talk focuses on requirements definitions, IT coordination across UVA’s academic and health system sides, and designing compliant storage pathways during infrastructure replacement.

SLIDES