Mostly outdated software. On a typical small practice computer, a vulnerability scan turns up browsers, PDF readers and Office versions that are missing security updates, an operating system past its end of support, and remote access tools nobody remembers installing. Fix anything attackers are already using first, then anything that will never get another fix.
That is the short version. Below is what each kind of finding means, how to rank them, which ones are false alarms, and how the results belong in your security risk analysis. If your question is whether HIPAA requires a scan at all, that is covered in Does HIPAA Require Vulnerability Scanning?
What a Vulnerability Scan Finds Again and Again
A scan compares what is installed on a computer against public lists of known flaws. On front desk and exam room machines, the same handful of categories come up.
Web browsers. Chrome, Edge and Firefox update themselves, but only when they are allowed to restart. A browser that has been open for three weeks is often several fixes behind. Browsers matter because they touch the internet all day. As of October 28, 2026, CISA's catalog of flaws attackers are actively using lists 65 entries for Google Chromium alone, the engine under both Chrome and Edge.
PDF readers. Patients send forms. Payers send remittances. Every one gets opened in a PDF reader, which makes an outdated Adobe Acrobat or Reader a favorite way in. CISA's catalog lists 23 Adobe Acrobat and Reader entries.
Old Office versions. Office 2016 and Office 2019 reached end of support on October 14, 2025, according to Microsoft's lifecycle page. They still open documents. They no longer get security fixes. A scan will flag them every time, and it should.
End-of-life operating systems. Windows 10 Home and Pro reached end of support the same day. Microsoft's own page says security updates are "no longer provided," and points to Windows 11 or its paid Extended Security Updates program (Microsoft, Windows 10 support has ended). A computer in this state will keep collecting new findings that never get fixed.
Remote access tools. ScreenConnect, TeamViewer, AnyDesk and similar programs are how your IT person helps you from home. They are also how attackers get in when the tool is old or the account is weak. CISA's catalog lists 4 ConnectWise ScreenConnect entries. The usual finding is not the tool your IT person uses. It is the second and third one left behind by a previous vendor or a one-time support call.
File compression and runtimes. WinRAR, 7-Zip and old Java runtimes sit quietly for years. CISA lists 4 WinRAR entries, including CVE-2025-8088, added in August 2025, and a 7-Zip flaw (CVE-2025-0411) that let files skip Windows' downloaded-file warning.
Vendor utilities. Printer software, driver updaters and "helper" programs from the computer maker. Nobody opens them, so nobody updates them.
Programs nobody remembers. Trial software, old toolbars, a game a former employee installed. Every one is something to keep patched or, better, remove.
How to Rank What the Scan Found
Most reports give each finding a CVSS score from 0 to 10, published by NIST's National Vulnerability Database:
| Rating | CVSS score |
|---|---|
| Critical | 9.0 to 10.0 |
| High | 7.0 to 8.9 |
| Medium | 4.0 to 6.9 |
| Low | 0.1 to 3.9 |
The score tells you how bad a flaw could be. It does not tell you whether anyone is using it. For that, check CISA's Known Exploited Vulnerabilities catalog, the federal list of flaws with evidence of real attacks. It held 1,762 entries on October 28, 2026.
A "High" that is on the CISA list outranks a "Critical" that is not. That is the single most useful rule for reading a report.
The False Alarms
Some findings are wrong, and a good report says so.
- Version guessing. A scanner may flag a program by its version number when the vendor fixed the flaw without changing the number the way the scanner expects.
- Already updated, not restarted. The fix is downloaded and waiting for a restart. Restart, then check again.
- Leftover entries. A program was uninstalled but left its listing behind.
Confirm before you spend money. A two-minute check with whoever manages the computer usually settles it.
What to Fix First
A simple order that works for a small office:
- Anything on the CISA list. Update it today. Browsers and PDF readers usually take minutes.
- Anything that will never be fixed. End-of-life Windows and Office. You cannot patch these. Plan the replacement and write down the date.
- Critical and High findings in programs that touch the internet or open outside files. Browsers, email, PDF readers, remote access tools.
- Programs nobody uses. Remove them. A deleted program has no vulnerabilities.
- Medium and Low findings. Put them on a schedule and work through them.
Then turn on automatic updates wherever they are off. Most of the findings above come back if updates stay off.
Where the Findings Go in Your Risk Analysis
The scan report is not the finish line. Under the Security Rule, it is evidence for two required steps.
The risk analysis, 45 CFR 164.308(a)(1)(ii)(A): "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate."
Risk management, 45 CFR 164.308(a)(1)(ii)(B): "Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a)."
In plain words: record what the scan found in your security risk assessment, then record what you did about each finding. Fixed, scheduled, or accepted with a reason. A remediation plan with an owner and a date is the format auditors expect to see. A scan report in a drawer, with nothing done, shows you knew about the problem.
Try It on One Computer
If you want to see this on your own front desk machine, our sample vulnerability scan checks one office computer for $59. A small report-only program sends us three things: the computer's name, its operating system version and updates, and the list of installed programs with their versions. It never touches documents, email, browsing, passwords or patient records. We check the list against published flaws and email a plain-English report, with what to consider fixing first, within one business day. The program removes itself after 3 days.
FAQ
What does a vulnerability scan look for on a computer?
It compares the operating system and installed programs against public lists of known security flaws. On office computers that usually means outdated browsers, PDF readers and Office versions, an operating system past end of support, and old remote access tools.
How many findings is normal for an office computer?
There is no useful normal number. One finding on CISA's Known Exploited Vulnerabilities list matters more than thirty low-rated ones. Rank by that list first, then by severity.
Do I have to fix every finding?
No. The Security Rule's risk management standard asks you to reduce risks and vulnerabilities to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)(B)). Fix what matters, schedule the rest, and write down any risk you accept and why.
Is Windows 10 still safe to use in a medical office?
Microsoft ended support for Windows 10 Home and Pro on October 14, 2025, and says security updates are no longer provided. Microsoft points to Windows 11 or its paid Extended Security Updates program. Record whichever you choose in your risk analysis.
Does scanning one computer tell me about the rest of the office?
Only about that computer. If your other computers were set up the same way and updated the same way, they may share the same gaps, which makes one scan a useful first look before checking the rest.
Conclusion
Most of what a scan finds on an office computer is ordinary: software that missed its updates and programs nobody remembers installing. Fix what attackers are already using first, replace what will never be fixed, and write down what you decided. That record is what turns a scan into risk management.
Want help putting this in place? The Full-Scope plan from One Guy Consulting pairs the compliance software with 4 hours a month of 1:1 implementation calls with Chuck Weiselberg, C.H.P., with no per-user fees. Book a free 30-minute intro call. No obligation, no pressure.
Sources
- Microsoft, Products and services reaching end of support in 2025
- Microsoft, Windows 10 support has ended on October 14, 2025
- CISA Known Exploited Vulnerabilities Catalog
- NIST National Vulnerability Database, CVSS severity ratings
- 45 CFR 164.306, Security standards: general rules (eCFR)
- 45 CFR 164.308, Administrative safeguards (eCFR)
Related Reading