Outdated software is a HIPAA risk because attackers use known, published flaws, and an unpatched computer still has them. HIPAA does not say "install updates" in those words. It does require you to assess the vulnerabilities to your ePHI and reduce them to a reasonable level. An old, unpatched computer is a vulnerability you already know about.
This article covers what "outdated" actually means, how attackers use it, what the Security Rule says, what OCR has said in its own enforcement titles, and a patch routine a small office can keep.
What Outdated Software Means for a Small Practice
There are two kinds, and they need different fixes.
Missing updates. The software is still supported, but nobody installed the latest fixes. Windows, macOS, your web browser, your PDF reader and your EHR's desktop app all publish security updates. A computer that skips them keeps the flaws those updates closed.
End of life. The maker has stopped fixing it entirely. No update is coming, no matter how long you wait. Microsoft's own support page says it plainly: Windows 10 "has reached the end of support on October 14, 2025. At this point technical assistance, feature updates and security updates is no longer provided."
Missing updates are a maintenance problem. End of life is a replacement problem. Both show up on a risk analysis.
How Attackers Use Old Software
When a maker fixes a flaw, it usually publishes what the flaw was. That helps defenders. It also tells attackers exactly what to look for on computers that did not update.
CISA, the federal cybersecurity agency, keeps a public list of flaws that attackers are known to be using right now: the Known Exploited Vulnerabilities catalog. As of October 28, 2026, it lists 1,762 of them. 390 are in Microsoft products. 361 are marked as known to be used in ransomware campaigns. 278 were added in 2026 alone.
Every entry on that list has a fix or a workaround. The attacks work on the computers that never applied it.
That is the whole point. Most attacks on small practices do not need anything clever. They need one computer that is behind.
What the HIPAA Security Rule Says
The Security Rule does not name software updates as a standalone requirement. Several requirements land on them anyway.
Risk analysis (Required), 45 CFR 164.308(a)(1)(ii)(A): "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate."
A computer running software with known, published flaws is a vulnerability. If it handles ePHI and your risk analysis does not mention it, the analysis is not accurate or thorough.
Risk management (Required), 45 CFR 164.308(a)(1)(ii)(B): "Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a)." Finding the old software is half of it. Updating or replacing it is the other half.
Protection from malicious software (Addressable), 45 CFR 164.308(a)(5)(ii)(B): "Procedures for guarding against, detecting, and reporting malicious software." Keeping software current is one of the most basic of those procedures.
Security reminders (Addressable), 45 CFR 164.308(a)(5)(ii)(A): "Periodic security updates." This sits under security awareness and training.
"Addressable" does not mean optional. Under 45 CFR 164.306(d)(3), you must assess whether each addressable item is reasonable and appropriate, implement it if it is, and if it is not, document why and put an equivalent measure in place if one is reasonable. For keeping software patched, it is hard to write a convincing memo explaining why that is unreasonable.
What the Proposed Rule Would Add
The January 2025 proposed overhaul of the Security Rule (90 FR 898) would add a "Vulnerability management" standard to the Security Rule's technical safeguards. In the proposal's own words, it would require practices to "deploy technical controls in accordance with the covered entity's or business associate's patch management policies and procedures," and to "monitor authoritative sources for known vulnerabilities on an ongoing basis and remediate such vulnerabilities." It would also require vulnerability scans at least every six months.
Status: proposed, not final. HHS's target for a final rule is July 2027. OCR is not enforcing it today. We cover the scanning side in Does HIPAA Require Vulnerability Scanning?
What OCR Has Said in Its Own Words
OCR announces each settlement with a title. Some of those titles say exactly what the problem was.
- December 2, 2014: "HIPAA Settlement Underscores the Vulnerability of Unpatched and Unsupported Software." That is OCR naming unpatched and unsupported software as the lesson of a case, more than a decade ago.
- November 22, 2016: "UMass settles potential HIPAA violations following malware infection."
Recent cases point at the step that should have caught old software in the first place: the risk analysis.
- July 29, 2026: OSF Healthcare System paid $552,250 to settle a ransomware investigation. The resolution agreement describes a risk analysis failure, the impermissible disclosure of 53,907 people's PHI, and late notification.
- March 5, 2026: MMG Fusion, LLC, a software company and business associate, paid $10,000. OCR said it had "potentially violated" HIPAA, including by failing to conduct an accurate and thorough risk analysis. OCR counted it as the 12th action in its Risk Analysis Initiative.
The pattern is consistent. OCR does not ask whether you were hacked through a clever attack. It asks whether you knew your weak spots and did something about them.
A Patch Routine a Small Office Can Keep
This does not take an IT department. It takes a list and a calendar.
- List every computer and what it runs. Front desk, exam rooms, the billing laptop, the computer in the back that nobody uses but is still on. Note the operating system and version.
- Turn on automatic updates for the operating system and the web browser on every one of them.
- Check the rest once a month. PDF readers, office software, the EHR's desktop app, remote access tools. Install what is waiting.
- Retire or replace end-of-life systems. If the maker no longer sends security updates, the computer should not be handling ePHI. If it must stay for a while, write down why, what you did to limit it (for example, taking it off the internet), and the date it goes.
- Write it down. Date, computer, what was updated, who did it. That record is your risk management evidence.
- Check your work. A vulnerability scan shows what is still out of date after you think you are finished.
NIST's Guide to Enterprise Patch Management Planning (SP 800-40 Rev. 4) goes deeper if your IT person wants a framework.
Where One Guy Consulting Fits
If you want to know how far behind one of your computers is, our sample vulnerability scan checks one office computer for $59. A small report-only program lists the installed software, we check every program against published flaws, and you get a plain-English report within one business day. It does not touch documents, email or patient records, and it removes itself after 3 days.
What you find belongs in your security risk assessment, and what you fix belongs in a remediation plan. Both are part of every plan on our pricing page. The Full-Scope plan adds 4 hours a month of 1:1 implementation calls with Chuck.
FAQ
Does HIPAA require software updates?
Not in those words. HIPAA requires an accurate and thorough risk analysis and security measures that reduce vulnerabilities to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)(A) and (B)). Known flaws in unpatched software are vulnerabilities, so keeping software current is how most practices meet those requirements.
Can we keep using Windows 10?
Microsoft ended support for Windows 10 on October 14, 2025, and says security updates are no longer provided. A computer that handles ePHI without security updates is a vulnerability your risk analysis has to address. Upgrading, replacing the computer, or Microsoft's Extended Security Updates program are the usual paths.
Is protection from malicious software required or addressable?
Addressable, under 45 CFR 164.308(a)(5)(ii)(B). Addressable does not mean optional: you must implement it if it is reasonable and appropriate, or document why not and use an equivalent measure if one is reasonable (45 CFR 164.306(d)(3)).
How often should a small practice install updates?
HIPAA sets no schedule. Automatic updates for the operating system and browser, plus a monthly check of everything else, is a routine most small offices can keep. Write down what you did and when.
Has OCR ever settled a case about unpatched software?
Yes. On December 2, 2014, OCR announced a settlement titled "HIPAA Settlement Underscores the Vulnerability of Unpatched and Unsupported Software." More recent cases focus on risk analysis failures, the step meant to catch outdated software.
Conclusion
Outdated software is not a technical footnote. It is one of the most common ways in, and HIPAA's risk analysis and risk management standards already expect you to find it and deal with it. Turn on automatic updates, check the rest monthly, retire what can no longer be patched, and keep the record.
Want help putting this in place? The Full-Scope plan from One Guy Consulting pairs the compliance software with 4 hours a month of 1:1 implementation calls with Chuck Weiselberg, C.H.P., with no per-user fees. Book a free 30-minute intro call. No obligation, no pressure.
Sources
- 45 CFR 164.306, Security standards: General rules (eCFR)
- 45 CFR 164.308, Administrative safeguards (eCFR)
- Microsoft, Windows 10 support has ended on October 14, 2025
- CISA Known Exploited Vulnerabilities Catalog
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
Related Reading