Thank you so much for your speedy reply!

My email is Cette adresse courriel est protégée contre les robots spammeurs. Vous devez activer le JavaScript pour la visualiser.. I'd love to share how we incorporated your valuable feedback into our proposed framework and get your final thoughts. We look forward to corresponding with you.

Sincerely,

Courtney

Hi Courtney,

This is looking really good. I currently lead Open Source Connect, Connected for Care, and the Ottawa PostgreSQL User Group. I would be happy to participate in an email exchange.

What I would say off the top is that Legacy Systems, administrators, and academics never supported the monopolization and vendor lock-in that we are currently facing. It's a complex issue that has resulted in a situation that compromises both security and total cost of ownership. However, as I am highlighting in an upcoming talk, the situation is complicated. Open Source solutions do not, inherently, enhance security. In fact, the Shai-Hulud worm has been released under an open source license on GitHub, causing catastrophic consequences (more info here: www.darkreading.com/application-security/shai-hulud-hackers-teampcp-lucky-skilled).

Categorizing a transition or migration by Immediate Resolutions or Future Mitigations would be difficult, if not impossible (for this issue, not for others, as you have identified). However, I would state, point blank, in the "Recommended Industry Best Practices" that open source solutions should be considered at every layer (operating system, database management system, electronic medical record system, hospital information system, etc.) in order to help mitigate the, frankly scary, consequences of monopolization.

Sincerely,
Katie

Hi everyone,

I am a Health Systems Management student at Fanshawe College. My group is currently completing an assignment for our Health Systems Environments course focused on the operational and cybersecurity challenges of Legacy Systems in healthcare. As part of our academic framework, we are required to consult with a healthcare IT, HIM, or security professional to briefly validate our strategic approach and get an industry "sign-off" (which can be a simple, quick email confirmation).

We have synthesized current literature (including Yelagam, 2025; Silvestri et al., 2023; and SOTI, 2025) into the following three-part framework:

Immediate Resolutions (Short-Term): Implementing strict network segmentation (VLAN isolation), applying compensating endpoint controls (disabling unused ports), enforcing enhanced access controls/MFA, and deploying continuous network monitoring (IDS).

Future Mitigations (Long-Term): Shifting from high-risk "big-bang" replacements to incremental modernization via Strangler Fig architecture, utilizing AI-driven threat intelligence (ML/NLP tools), and piloting decentralized data architectures (blockchain).

Recommended Industry Best Practices: Establishing risk-based vulnerability frameworks, mandating security-focused procurement SLAs for medical devices, utilizing network-level Virtual Patching via IPS, and transitioning capital models to reflect Total Cost of Ownership (TCO).

Would any privacy, security, or HIM professional in this community be open to reviewing this strategy via a quick email exchange? We just need to know if these points align with your real-world operational experiences or if there is a critical healthcare deployment hurdle we missed.

If you can help us with this before our Wednesday, June 3rd deadline, please reply here or send me a direct message. Thank you so much for supporting local health informatics and management students!

Sincerely,

Courtney