Windows XP Won’t Be HIPAA Compliant April 8, 2014

I’ve been telling practices about this for months, hoping they will create a smooth plan to replace these desktops rather than wait until April 1 and be angry and complaining about the cost and the downtime to replace all of the computers at once.

From our audits, I see still about half of the computers at use in private practice to be XP.
And why not? It works.

Yes, the lack of understanding about HIPAA compliance is truly amazing, yet I’ve gotten over that surprise now and really, I’m surprised when an office has their act together…which is also sad.

Working at a small to medium sized specialty group that interacts with several different hospital systems and other medical groups I personally am NOT amazed at the lack of understanding of HIPAA and HIPAA compliance. When you read the actual law, which I’m convinced very few people really do, CFR 160, 162 and 164 it appears to leave a great deal open to interpretation, and there are MANY conflicting interpretations in writing and in practice. There is no ONE way to do a security assessment for example, only guidelines. The hospitals we deal with have widely varying practices on the security requirments of their many applications. Resources available are few and healthcare reimbursement has been dropping despite rising health care costs for many years. It’s difficult for fiscally responsible small-medium sized organizations to manage. Hell, it’s difficult for our enormous government to follow the law. Surely most who follow current events in healthcare have read about the security problems with the Healthcare.gov website? Did they shut it down until it was deemed HIPAA compliant? No they forged ahead to avoid a political nightmare.

I spent several months this year working in a major bank (on a fill in contract). The firm was putting huge efforts into migrating all users to Win 7 ASAP and was at least half done when I departed. The effort was somewhat painful, and interfered with other projects, but it had very high priority. The bank did what it could to ease the pain and provide training and support.

Keep in mind that banks and health care providers have parallel requirements for security and privacy. But in nearly every medical practice I’ve been to in the last year or two, XP is still king. Of course, most still don’t have EHR’s yet!

I visited ‘my favorite’ hospital last week, and around the hospital – which has had an EHR for a few years (except for the ER, which kind of sort of has one), every PC I observed was running XP.

This hospital is part of a huge hospital system which has dozens of IT job openings that it has trouble filling, and is clearly way behind on getting past XP, but still won’t even consider hiring anyone without extensive hospital IT PLUS clinical experience. If they were not so stubborn they might actually hire people who understand privacy and security issues in computing, and who are Win 7 capable. But IMHO they’ve got their heads buried in the sand and can’t see the end of the tracks for Win XP just months away, with the huge HIPAA and support problems that entails. Sure, they may pay Microsoft for some months of extra support – and therefore avoid immediate HIPAA violations, but they still miss the point – XP is not secure.

I agree with your points 100%.

As someone from the technology industry (who is intimately familiar with system administration, virus/malware risks, and PCI compliance, I’ve been trying to warn people about the Windows XP EOL for awhile now.

Unfortunately, when talking with less technical folks, it’s often like we’re speaking different languages. They dismiss the issues, saying things like “hackers have had 12 years to find exploits.”

Almost all of the old Windows XP machines are networked. It’s a very dangerous situation.

I wrote a blog post on the Windows XP EOL recently. You may be interested in it: http://www.additiveanalytics.com/blog/04-08-2014-will-organization-lose-hipaa-compliance/

I don’t foresee the XP doom and gloom as others here do. I think many practices are going to ignore this. Already, MU Stage 2 will be avoided by many practices, especially when they hear they have to incorporate secured messaging, which means Legally they are bound to answer things in writing they did not answer before, lack of answer and you could be equally in trouble. I feel the same with the XP end of life, many practices, especially those on a hosted/saas/cloud based solution will defer to the Firewall and Security on the Hosted Side, therefore, rendering less critical the device, albeit Windows (XP,7,8,8.1,RM), Mac, Android or IOS IPAD, or whatever comes to fruition in the future.

Bottom line is PC obsolescence is could end up being the death nail to a already rejected comment that EHR’s save time and money. Adding these expenses, Portal Expenses, HIE integration, Patient Messaging, GEEZ WHAT DOES THE SMALL UNDER 10 DOCTOR GROUPS GOING TO DO. Clearly I see from many end users they will simply not comply and take penalties and eventually de-install to save money and pay the small stick the Government is passing out.

Here is a question for this topic. What if the IT system is virtual via Citrix XenDesktop and everyone runs on a Virtual Windows 7 computer in the cloud but the endpoint that they connect from is Windows XP that is joined to the domain and locked into a FAT Client where they are unable to get to the XP OS and are immediately pushed into a Virtual Machine where they do their work? Are the XP dumb terminals a compliance issue even though XP is used only to run “Citrix Receiver” and “Citrix Appliance Lock” to allow the user to enter the Windows 7 environment?