5 ms·

We're in healthcare and just found out a couple of our users are using Windows XP. I'm no lawyer, but I think that's illegal.

by fudgy73 10y ago

mortenjorck 10y ago
If they're using XP to work with protected health information (PHI), and aren't on an extended service contract with Microsoft, they're accessing PHI on an insecure system and are, at least to how my team would interpret it, in direct violation of HIPAA. In fact – and I too am not a lawyer, so don't consider this actionable advice – you might do well to throw up a warning, if not altogether disable access, to whatever product it is your users are accessing on XP, just to make sure you have all your HIPAA bases covered.
- azinman2 10y ago
  I bet you a significant portion of healthcare is running xp. This is not a fast moving industry, and "if it ain't broke don't fix it." Hypothetical security isn't something most healthcare workers will consider broke.
- pageld 10y ago
  The key phrase is "my team would interpret it." Everyone interprets HIPAA differently and based on a statement like: "Continuing to use Windows XP after 4/8/14 (or other unsupported operating systems) becomes a HIPAA violation if it’s not addressed in your security risk analysis[0]." You can run XP indefinitely as long as your IT says it's OK and they've "secured it properly." However, if they do get hacked or whatnot, they can get a fine if their security analysis wasn't good enough. I don't recommend it. I actually despise it and try my hardest to get people to drop it. But in the end, I've had to deal with a lot of XP running IE8 systems that need connections to the software I'm in charge of. There's nothing I can do unless I get rid of those users and most of the time I can't because I have to "support modern browsers" as noted in the contract and the contract is with the state, not the individual users. Yes, the contracts will get updated to be more specific, but most of the contracts are on 5 year cycles. State .gov contract work is amazing. /s [0] https://pimsyehr.com/resources/compliance/hippa-compliance/241-com-pbm-phc-pem-will-windows-xp-violate-hipaa-as-of-4-8-14 https://pimsyehr.com/resources/compliance/hippa-compliance/2...
- ci5er 10y ago
  Uh... no. HIPAA might be an imprudent bear of a politician's bad idea masquerading as pretending to help, but it isn't that specific.

We're in healthcare and just found out a couple of our users are using Windows XP. I'm no lawyer, but I think that's illegal.

by fudgy73 10y ago

We're in healthcare and just found out a couple of our users are using Windows XP. I'm no lawyer, but I think that's illegal.

mortenjorck 10y ago

If they're using XP to work with protected health information (PHI), and aren't on an extended service contract with Microsoft, they're accessing PHI on an insecure system and are, at least to how my team would interpret it, in direct violation of HIPAA. In fact – and I too am not a lawyer, so don't consider this actionable advice – you might do well to throw up a warning, if not altogether disable access, to whatever product it is your users are accessing on XP, just to make sure you have all your HIPAA bases covered.

azinman2 10y ago
I bet you a significant portion of healthcare is running xp. This is not a fast moving industry, and "if it ain't broke don't fix it." Hypothetical security isn't something most healthcare workers will consider broke.
pageld 10y ago
The key phrase is "my team would interpret it." Everyone interprets HIPAA differently and based on a statement like: "Continuing to use Windows XP after 4/8/14 (or other unsupported operating systems) becomes a HIPAA violation if it’s not addressed in your security risk analysis[0]." You can run XP indefinitely as long as your IT says it's OK and they've "secured it properly." However, if they do get hacked or whatnot, they can get a fine if their security analysis wasn't good enough. I don't recommend it. I actually despise it and try my hardest to get people to drop it. But in the end, I've had to deal with a lot of XP running IE8 systems that need connections to the software I'm in charge of. There's nothing I can do unless I get rid of those users and most of the time I can't because I have to "support modern browsers" as noted in the contract and the contract is with the state, not the individual users. Yes, the contracts will get updated to be more specific, but most of the contracts are on 5 year cycles. State .gov contract work is amazing. /s [0] https://pimsyehr.com/resources/compliance/hippa-compliance/241-com-pbm-phc-pem-will-windows-xp-violate-hipaa-as-of-4-8-14 https://pimsyehr.com/resources/compliance/hippa-compliance/2...
ci5er 10y ago
Uh... no. HIPAA might be an imprudent bear of a politician's bad idea masquerading as pretending to help, but it isn't that specific.