Here’s a plausible scenario from the not-so-distant future. It’s 2 a.m. on a holiday weekend, and a hospital’s claims or records system throws an error. This is mission-critical infrastructure we’re talking about, and these systems process mountains of personally identifiable information every hour of every day. Night staff at the security operations center need to know: Is this just a routine glitch or is there an active breach? However, there’s only one person who knows the answer — and she retired last spring.
This kind of nightmare situation should keep everyone involved in healthcare IT up at night. However, the industry tends to obsess over new threats while ignoring this looming risk. While leaders are rightly worrying about future-proofing their systems against risks like quantum computer decryption, they continue to let the RPG skills gap grow more dire.
That approach is no longer tenable. Demographic trends are backing healthcare IT organizations in a corner, and leaders up against the clock must take action now to ensure knowledge about these systems persists even after the current generation of RPG developers hangs up its hat.
The overlooked layer
Underneath the patient’s portals, mobile apps and analytics dashboards that get all the attention, most hospitals and health systems are still running their core operations on something far less glamorous. Claims processing, patient records, scheduling, billing — the systems that actually keep a healthcare organization solvent and functioning day to day — were mostly built decades ago in RPG and COBOL. These workhorse systems are largely still in place, doing their jobs efficiently and reliably.
These systems predate most of the IT staff now responsible for them. They were built by a generation of developers who understood not just the code but the business logic embedded in it — why a particular field validation exists, why a batch job runs at a specific hour, why an integration point was built the way it was, etc. And because these systems have run reliably for so long, they’ve earned a reputation as “stable.” Stable, in practice, becomes shorthand for “nobody touches it,” which quietly slides into the “nobody really watches it” category.
That’s not a failure of planning so much as a natural consequence of how well these systems work. Organizations facing tighter budgets and more urgent modernization priorities elsewhere had every reason to leave them alone. The result is a layer of healthcare infrastructure that carries enormous risk and enormous responsibility being run by a shrinking pool of people who understand it.
The real risk isn’t the language, it’s the knowledge
It’s tempting to treat RPG and COBOL themselves as the vulnerability — as if the code were somehow less secure simply for being old. But there’s nothing about these languages that’s inherently insecure. The real danger is that fewer people understand how these specific systems behave under normal conditions.
Incident response depends on understanding the baseline. Before anyone can determine whether an anomaly is a routine glitch or an active compromise, someone needs to know what “normal” looks like for that system. This includes things like what a typical batch job produces, which errors are cosmetic, and which are early warning signs, and how the system usually talks to the systems around it. Currently, that knowledge lives in the heads of the people who have spent years watching the system behave.
When that knowledge thins out, it affects everything downstream. A security team that would otherwise triage an incident in minutes instead spends hours just figuring out what they’re looking at. In a breach scenario, those hours matter. And in a healthcare environment especially — where the data at stake is protected, health information and the systems involved often can’t fully recover from extended downtime — those hours can have a direct patient impact.
Not every consequence of the RPG skills gap manifests as a dramatic breach, either. Some of the most pernicious risks are quieter than that — slow leaks rather than sudden ruptures. Think of a permission setting configured years ago for a use case that no longer exists, or an integration point that was patched around rather than properly updated, because updating it correctly would have required understanding design decisions nobody currently on staff was part of. These are the kinds of errors that go unnoticed when no one on staff understands the system’s original design. They don’t show up as an “incident.” At most, they’re a footnote in an audit — until something else goes wrong, and the house of cards comes tumbling down.
Why this gets worse, not better
The trajectory here isn’t going to reverse on its own. The specialists who hold deep RPG and COBOL knowledge are retiring, and the pipeline of people entering the workforce with any level of fluency is barely a trickle by comparison. Organizations that hoped AI would be able to fill the gap are hitting a barrier. While an AI model can help rewrite a COBOL routine into something more contemporary, it can’t tell you why a given routine was built the way it was in the first place or what edge case a seemingly odd piece of logic was written to handle.
In short, AI lacks the institutional knowledge that made the original team effective. And that context is exactly what matters most in the middle of an incident, when the difference between a fast, confident response and a slow, uncertain one comes down to someone recognizing what they’re looking at.
Knowledge transfer as a security best practice
The instinct in healthcare IT is to treat this as a staffing problem or, at best, an item on a modernization roadmap — something to address eventually, if budget permits. That instinct undersells the stakes. Documentation, cross-training and succession planning for legacy systems belong in the same category as patching schedules and access control reviews: core security hygiene, not “nice-to-haves” that get deprioritized when resources are tight.
Treating institutional knowledge as an asset that needs deliberate protection means building structured processes around it. Organizations should pair veteran RPG and COBOL specialists with newer staff well before retirement is on the horizon so they can document not just what the code does, but why it was built that way. Veteran-rookie teams can work together on incident response runbooks that capture the judgment calls a specialist would make instinctively. This is hardly glamorous work, to be sure, but it could ultimately determine whether a 2 a.m. anomaly gets resolved in twenty minutes or twenty hours.
Where this leaves healthcare IT
Given these challenges, the instinct might be to conclude that the real fix is ripping out this old system entirely and replacing them with something modern. Sometimes that’s the right call (although it’s rarely the fastest). But the more urgent fix is making sure that the knowledge from one retired developer doesn’t represent the loss of an entire cohort of accumulated IT knowledge.
Healthcare cybersecurity professionals have spent years learning to protect networks and data with increasing sophistication. It’s time the industry gives due attention to the knowledge residing in the heads of the people who keep its essential systems running. Preserving that knowledge isn’t a matter of historical curiosity — it’s a security requirement that healthcare can no longer afford to overlook.
About Jennifer Nelson
Jennifer Nelson has spent the bulk of her career in mainframe space, including 15 years at Rocket Software and five years at BMC. In 2019, she left Rocket to work in senior engineering roles at global technology companies outside of the Z world. In early 2024 Jen began working on what would become Izzi Software, which is currently acquiring software companies on the Z Systems and IBM Power platforms.
