Is Your HIPAA Compliance Program Going Out The Window With XP?

April 8, 2014 marks the end of Microsoft's support for the Windows XP operating system, which means the end of security updates from Microsoft and the beginning of new vulnerability to hackers and other intruders into systems still utilizing the operating system. But does the end of Windows XP support mean that HIPAA covered entities and their business associates using Windows XP are automatically out of compliance with HIPAA as of April 8th? Not necessarily.

It is impossible to say with certainty that April 8th equals HIPAA non-compliance for XP users. There is no one-size-fits-all answer as to whether or not continued use of XP will result in a HIPAA violation, because there is no one-size-fits-all approach to compliance with the HIPAA Security standards. HIPAA Security standards are "flexible and scalable" to ensure that each regulated entity may implement security measures that are reasonable in light of the size and complexity of the organization. As a threshold matter, users of Windows XP must determine whether or not electronic protected health information or ("ePHI") even passes through an affected system. XP users should also evaluate whether or not there are compensating security measures to protect ePHI or whether additional security measures could be implemented to temporarily protect ePHI, such as disconnecting affected computers from the internet.

However, Microsoft has been sounding the warning bells about the end of support for Windows XP for quite some time now: "We just did not know" likely casts doubt on whether your organization has been sufficiently diligent. The official End of Life Information Center has some good baseline information. The issue becomes that there will be no...