Intelligent Refactoring of a Legacy VB6/WinForms HealthTech System

The story began with a HealthTech company in Illinois that provided outpatient therapy and billing solutions for small medical practices. For nearly two decades, their core product — a desktop system built on VB6 and classic WinForms — had quietly run the administrative backbone of hundreds of clinics. It worked, but it was stuck in the past.

Having led the company’s engineering since 2000, David M., the VP of Engineering, partnered with Devox Software to modernize a long-standing VB6/WinForms healthcare platform. He needed an experienced engineering partner with deep expertise in legacy systems — one that could navigate the complexities of outdated desktop architectures while ensuring business continuity.

Applying our unique engineering approach and AI Code Assistants, we first brought the familiar WinForms interface onto .NET 8 to keep everything stable and familiar, then began shaping a new, more flexible design through Avalonia and MAUI prototypes for the future.

• 1 Project manager
• 2 Backend engineers
• 2 Frontend engineers
• 1 Data engineer
• 1 QA automation engineer

• Legacy Code Complexity. This old VB6 system was a monolith with over 400K lines of code and had undocumented dependencies and COM calls everywhere, and it was a total pain to work with.
• Regulated Environment. We faced strict HIPAA and FDA Part 11 requirements, including detailed change logs, approvals, and rigorous controls over ePHI during AI-assisted development. We had to have SOC 2-ready, self-hosted assistants that could be trusted.
• ActiveX and COM Interop. The system relied on ancient ActiveX controls and custom DLLs for device I/O and report rendering, which meant 64-bit migration was completely out of the question.
• Short Timeline Before Audit. We had less than 12 months to get the whole thing done before the next compliance audit — this meant we had to modernize, test, and document everything before the clock even started ticking.

• Backend: C#, .NET 8, ASP.NET Core Services
• Frontend: Frontend: WinForms (on .NET 8), Avalonia (prototype phase for cross-platform UI exploration).
• Database: PostgreSQL, SQL Server Legacy Bridge
• Infrastructure: AWS ECS / EKS, RDS, S3, CodePipeline
• AI Assistants: GitHub Copilot, Sourcegraph Cody (on-prem), Amazon Q Developer
• Migration Tools: Mobilize VBUC, .NET Upgrade Assistant
• Security: AES-256, TLS 1.2+, SOC 2 policies, MFA, audit logging
• Compliance Frameworks: HIPAA, FDA 21 CFR Part 11, IEC 62304

After twenty years of keeping the same system alive, change felt risky — almost personal. Every engineer on the team had poured their heart into that code. We built trust one small step at a time, making sure everyone stayed in the loop with full transparency and no surprises — until the benefits became clear. We built trust first: small steps, full visibility, zero surprises. Once the team saw their logic improved — not replaced — pride took over.

In the end, we didn’t scrap their system. We evolved it — into a modern .NET 8 platform that kept what worked and freed them from what didn’t.

• Automated Refactoring Pipeline. 70% of the VB6 to C# syntax and API conversions were automated with the help of code assistants & pre-recorded tests (“golden master”). We started off with VBUC and .NET Upgrade Assistant to translate the initial projects, while Copilot & Cody came in handy for tidying up the domain logic & extracting it into clean service layers.
• Golden-Master Validation. Before migrating each module, we recorded how it behaved under various inputs and outputs, then ran it again after the refactor and compared the results to make sure it still worked as expected.
• UI Modernization Strategy. The modernization plan first lifted the existing WinForms interface onto .NET 8 for stability, then advanced toward a cross-platform Avalonia/MAUI prototype to explore next-generation desktop and tablet UX.
• Secure AI Operations. All AI assistants operate in isolated SOC 2 environments with no data retention — neither ePHI nor source code is stored longer than necessary. Using Sourcegraph Cody to search and generate diffs across private repos without the hassle of having to upload anything to the cloud.
• Continuous Testing. Every time we update the code — meaning each refactor commit — we attach a digital signature in line with FDA Part 11 rules. To make traceability easier, we connected requirements, code functionality, and test results in a clear, auditable way. And during our build process, our CI/CD pipelines are constantly running regression tests to ensure we still meet all the certified requirements.
  

BUSINESS OUTCOMES

• 90% reduction in manual refactoring hours. AI-assisted conversion accelerated delivery by 6 months versus traditional approaches.
• Zero production downtime. The migration was executed through phased deployments, with dual builds running in parallel.
• Audit-ready documentation. Automated trace links and Part 11-compliant signatures made the HIPAA audit process easier and more transparent.
• Modern platform readiness. The refactored code is now in a state where we can start plugging in some of the more advanced AI and machine learning modules for predictive analytics and decision-making tools that make clinical decisions.

TECHNICAL OUTCOMES

• We refactored 400,000 lines of VB6 code to C#, guided by AI tools throughout the process.
• We introduced a modular .NET architecture with clearly separated data access and domain layers.
• We implemented SOC 2-grade security and CI/CD pipelines with fully traceable deployments.
• We reduced average build time by 45 percent and test execution time by 30 percent.
• We established a solid foundation for future cross-platform UI development.