EHR migrations move clinical data from one system to another under time pressure and organizational scrutiny. FHIR Bundles carry that data across the boundary in nearly every modern migration, and the failure modes at the Bundle layer are the ones that turn a scheduled cutover into a rollback. Bundle validation is not a formality in that setting; it is the checkpoint that separates a controlled migration from an incident.
Programs treating validation as a downstream sweep discover the gaps too late. Related connectivity notes sit under additional EHR connectivity walkthroughs for the wider migration surface.
Bundle Validation Named as a Risk Control
Migration risk registers routinely list data loss, mapping errors, and downtime. Bundle validation belongs on that register too, as a distinct control:
- Structural conformance — catches malformed payloads before they land in the target.
- Reference integrity — catches cross-resource references that lose their targets in translation.
- Profile conformance — catches cases where the target enforces a profile the source did not.
- Cardinality drift — catches fields the source produced sparsely and the target expects populated.
Each control maps to a validator check that can run in a staging environment before the cutover window. A pass through the site's Bundle JSON check illustrates the structural subset on a single Bundle.
Staging Rehearsal Before Cutover
The reliable pattern is a full rehearsal against a staging endpoint on the target EHR. Representative Bundles from the source system flow through the migration pipeline, hit the target's validator, and produce a report. The report becomes the go/no-go artifact for the cutover meeting.
Staging that skips Bundle validation catches the resource-level issues but leaves the Bundle-layer ones for production. That is exactly the class of issue that triggers rollback in the first hour of a cutover.
Rollback Triggers Named in Advance
Migration playbooks that name rollback triggers explicitly reduce the decision cost during the cutover window. Bundle-layer rollback triggers usually cluster around three signals:
- Rejection rate above threshold — a percentage above the acceptance program's tolerance.
- New rejection code appears — a code that did not appear in staging is showing in production.
- Reference resolution failures spike — cross-resource references stop resolving at expected rates.
Each trigger corresponds to a validator report metric that can be watched in near real time. Playbooks that leave the triggers to on-the-day judgement inherit avoidable decision latency.
The Terminology Gap Applies Here Too
Migrations that carry terminology bindings across systems frequently encounter the case where structural validation passes and terminology validation fails. Source-system codes that were legal in the source's value sets fall outside the target's tightened bindings. For the specific split between the two layers, when Bundle validation passes but terminology fails covers the mechanics.
Post-Migration Audit Artifact
The validator report from the cutover window is a persistent audit artifact. Programs retain it in the migration record along with the rollback triggers, the go/no-go decision, and the incident log. For the cost side of what the artifact prevents, the true cost of shipping an invalid FHIR Bundle collects the concrete downstream numbers.
Naming Bundle validation as an explicit migration control makes the decision costs visible in advance, which is the point of a risk register in the first place.
Sources
- HL7 US Core Implementation Guide STU 6.1.0 - HL7 US Core Implementation Guide STU 6.1.0, canonical target-side profile package for EHR migrations