Does your shop handle personal health information (PHI) that falls under the HIPAA regulations? If so, does your company follow the HIPAA Security Rule that requires you to guard against, detect, and report malicious software? Are you sure?
Many companies are surprised to find devices connected to their networks are still running Microsoft’s popular Windows 7 operating system. Experts estimate around 30% of computers in use today are still running Windows 7.
Windows 7 Support is Ending
Microsoft supports Windows 7 with security patches that protect the devices from the latest viruses and vulnerabilities, as the HIPAA rules require. But that’s about to change. On January 14, 2020 Windows 7 will reach end of life and Microsoft will no longer support the operating system. That means Windows 7 desktop computers, laptops, and devices will no longer comply with the HIPAA Security Rule. After January 14
th, a single Windows 7 device could provide a gateway to sensitive data elsewhere on your network. This device could support production equipment rather than sitting on someone’s desk for general use.
Some users consciously continue to use the reliable Windows 7 platform. If the system has been running without issues, companies may not have spent the money to upgrade. Another reason is compatibility with legacy application software. Your shop may run some older software on an aging machine. Perhaps production equipment for which you’ve long ago ceased paying maintenance is still in use. Or an infrequent job requires some ancient software running on a computer that otherwise would have been retired. These are situations where a Windows 7 vulnerability might go unnoticed until it’s too late.
The deadline is fast approaching. You should develop migration plans and begin converting soon to avoid a mad rush in January-an especially busy time for many print and mail service providers. Windows 7 computers will still work after January 14
th, but they will become attractive targets for hackers eager to gain access to valuable PHI.
Server Software Support Expires Also
Microsoft will also drop support for Windows 2008 R2 server software on January 14
, 2020. Servers toil away in back rooms and enjoy a longer lifespan than desktop workstations. Companies may overlook then as they inventory their computers and identify machines to replace. The servers running Windows 2008 R2 are likely underpowered. The hardware will probably need replacing with newer machines capable of running Windows Server 2019.
Be cautious as you dispose of old workstations and servers. You don’t want to cause a new HIPAA violation while you’re working to avoid another! You should wipe hard drives that might contain PHI data using a secure method or you can destroy the drives. If you use an outside service provider for these tasks, be sure they provide a certificate of destruction. File the certificates with your HIPAA documentation to prove your due diligence in protecting unlawful access to PHI.
DDS Has You Covered
Since Microsoft announced the end of support for Windows XP and subsequently Windows 7, DDS began moving applications onto a Windows 10, 64-bit platform. For older systems, we offer a cost effective upgrade program so our customers can take advantage of our 64-bit software and the enhanced security features available in Windows 10.
Many times, software vendors must modify applications written for older operating systems to run them on Windows 10. DDS made many changes to our software products to run effectively and efficiently on the new operating system. Not all of our competitors have done the same or they have not "qualified" their products for Windows 10.
If you own equipment supplied by anyone other than DDS, be sure to double-check your risk exposure before the end of the year.
If you bought your equipment after DDS moved our applications to Windows 10, or you’ve upgraded the operating system, your DDS equipment complies with the HIPAA Security Rule. You can continue working with PHI data, confident in your compliance with the HIPAA Security rule.
For more information about ensuring your operation is HIPAA compliant, contact Document Data Solutions today.
