Pharmacy Software Vendor Exit Plan: Verify the Handover

A pharmacy software vendor exit plan defines what must be transferred, how the transfer will be accepted and what happens to access and remaining records. Cancellation alone does not complete the handover.

The supplier offers a download before the contract ends. The file opens, but nobody has checked whether attachments, historical context and outstanding work are included.

This guide offers an owner checklist for Australian community pharmacies. It is not a dispensing-system migration procedure; use qualified professional and technical support for affected services.

Start the pharmacy software vendor exit plan before notice

Identify the service being ended and the workflows that depend on it. Include connections, support arrangements and any related services bundled into the agreement.

Read the existing contract with appropriate advice. Check notice, renewal, export, assistance, charges, access after termination and treatment of retained information.

Don’t assume a standard exit right, export format or migration service. Record what is actually agreed and which questions still need a written answer.

The ASD procurement and outsourcing guidance addresses data portability and protection after contracts end. Use it as a planning reference, not a universal pharmacy compliance checklist.

Appoint an accountable pharmacy owner for the exit. Identify the outgoing provider, receiving provider and internal people who approve their respective work.

Agree decision dates separately from cancellation dates. The plan needs a point at which unresolved problems can pause the change before required access disappears.

Define the records and work that must survive

Create an inventory of relevant data classes and functions. Start with what the pharmacy must continue to retrieve and do, rather than the vendor’s easiest export.

Check records, attachments, correspondence, audit history and outstanding work where applicable. Identify the relationships that give an exported item its meaning.

Document which system currently owns each record. Include information held by related providers so one export does not silently omit a connected service.

The OAIC security guide explains that outsourced storage can remain information an organisation holds. Changing suppliers does not, by itself, end those responsibilities.

Keep retention and retrieval requirements visible during planning. A new application may support current operations while an approved archive remains necessary for older records.

Our health-record access guide covers individual retrieval requests. Check that the exit will not leave staff unable to locate the relevant information.

Agree an export specification and acceptance test

Write down the format, covered dates, fields, attachments and delivery method. Ask the receiving provider to confirm what it can actually interpret before the final export.

Distinguish a readable file from usable transferred records. A spreadsheet may open successfully while losing relationships or the meaning of coded values.

Use a documented acceptance process approved for the affected data. Where possible, begin with non-patient test material before handling an authorised production export.

Protect any real records used for verification through approved access and transfer arrangements. Don’t create demonstration copies in personal email or unmanaged storage.

Exit question	Evidence to request	Decision before closure
What is included?	Export scope and exclusions	Whether anything required is missing
Can it be interpreted?	Field definitions and receiving-provider checks	Whether meaning and relationships survive
Can it be retrieved?	Approved search and retrieval checks	Whether required users can locate records
What remains open?	Outstanding-work reconciliation	Who owns each unresolved item
What remains with the supplier?	Retention and deletion statement	Whether continuing custody is appropriate
Which access ends?	Account and connection inventory	Who verifies withdrawal at the right time

Record discrepancies and their owners. A supplier’s completed transfer task should not automatically become the pharmacy’s acceptance decision.

Compare expected record counts and inspect representative current and historical records through approved checks. Investigate missing attachments or relationships rather than accepting matching totals alone.

Plan the change window and recovery decision

Agree when data entry changes and which system is authoritative during the transition. Record how updates made after an initial export will be reconciled.

Have qualified people approve the operating arrangements for affected services. A general owner checklist should not authorise a workaround for inaccessible dispensing records.

Define what happens if acceptance fails. Identify who can postpone closure and what support remains available under the actual agreement.

Keep customer communication aligned with the approved service plan. Avoid promising normal availability before the people responsible have confirmed the arrangements.

Our business continuity guide covers temporary disruption. Vendor exit adds a permanent handover decision and the eventual withdrawal of old access.

Test the relevant recovery or retrieval arrangement with your technical provider. Record the outcome rather than assuming that possessing a backup establishes recoverability.

Withdraw access when its job is complete

Inventory staff accounts, supplier support accounts, remote tools and service connections. Identify which remain necessary during the agreed transition and which can be ended.

ASD system-access guidance addresses account lifecycle management. Use authorised administrators to carry out and verify the required access changes.

Check more than the visible application login. Ask the technical owner about remote access, integration credentials, scheduled transfers and shared management arrangements.

Don’t withdraw necessary access before records and continuing work have an accepted home. Conversely, avoid leaving broad support access open indefinitely because the exit lacks an owner.

Record continuing arrangements with a purpose, responsible person and review date. Our offboarding checklist provides a related access-and-custody structure.

Confirm retained information and close exceptions

Agree what happens to information remaining with the outgoing provider. Include copies and backups in the questions, along with any applicable retention requirement.

The APP 11 guidance makes disposal dependent on permitted purposes and retention exceptions. Immediate blanket deletion is not a safe default.

Ask for evidence covering the agreed disposition. Distinguish completed deletion, authorised retention and a technically unresolved copy rather than accepting one ambiguous closure message.

Retain the exit record, acceptance evidence and continuing responsibilities in the approved system. Keep sensitive export files subject to their own authorised handling decision.

Close the exit only when required records are retrievable, continuing work is assigned and unresolved exceptions have an accepted owner. A terminated invoice is one administrative milestone.