Planning For Windows 10 End of Life

Why is this important?

• Keeping your operating systems up to date ensures your clinic’s operations are less likely to be disrupted by malware. Even if your EMR is entirely cloud-based, a successful ransomware attack can disrupt business operations for days until your computers are able to be restored. The 2017  cyberattack on the NHS in the UK took advantage of unpatched vulnerabilities in the Windows XP operating system, which had reached End of Life in 2009.
• Security updates are also critical to ensuring that your patient data is better protected from malware. Estimates based on black market transaction histories and published prices show that health record data is worth about 50x more than credit card data.
• The CareConnect Privacy and Security Declaration requires that there are no computers with legacy or end-of-support operating systems used to access CareConnect. Your EMR may also have a similar requirement in the Terms of Service; this is a standard security measure to ensure that the devices used to access patient records are less likely to be compromised.

What can I do?

• If your computers support it, upgrade your operating system to Windows 11.
  To check if your computer meets the requirements for Windows 11, you can either download the Microsoft PC Health Check App or review the system requirements table here. Most EMR’s (eg Med Access, CHR, Oscar Pro, Oscar Juno) are accessed through the web, but if your EMR is a standalone piece of software, contact your EMR provider to verify that it is compatible with Windows 11 before upgrading your operating system.
• Replace any Windows 10 computers that can’t be upgraded.
  There are many low-cost PC’s and laptop options that may suffice for normal use at a clinic. Depending on what software your clinic uses and how patient records are managed, there may be no need for an expensive high performance device with lots of storage capacity. Consult with a trusted IT provider to determine what your clinic’s computing needs are, and remember that often there are substantial sales on computers (eg back to school, Black Friday, etc), as well as bulk pricing available through many IT providers if you have many Windows 10 devices that need to be replaced. Your clinic is not alone in this issue, and you may find that you are able to access better prices if you are able to form a group of clinics within your community to purchase in bulk.
• Enroll in the Windows 10 Extended Support Program (ESU) if you need a bit more time.
  This program will extend support for security updates for one year (until October 13, 2026) to give you a bit more time to make a plan and purchase new devices. You have three ways to enroll in the ESU program, which will give you a license to use on up to 10 devices:
  • Linking a Microsoft account to the PC, and backing up the settings to make it easier to transition to Windows 11. This option is free.
  • Spending 1000 Microsoft rewards points.
  • A one-time cost of $30USD

  Note that the ESU extends support for security updates for only 1 year, so this option is only a temporary measure to ensure your computers remain protected by the latest security updates until you are able to replace your devices with ones that are supported.

What do I do with my old devices?

According to Doctors of BC Guidelines based on PIPA and PIPEDA, hard drives that contain patient records should be destroyed by physically damaging the item and discarding it. These guidelines also suggest that a wipe utility may also be used, but warn that it may not completely erase the information, so use caution if you choose this approach to ensure that patient information is erased in such a way that it cannot be recovered.

Note that even if your EMR is entirely web-based, if there have ever been patient files such as PDF records or imaging downloaded to the computer, or scanned for upload to the EMR, the hard drive will still need to be erased or destroyed, even if the file(s) were subsequently deleted. This is because deleting a file in computer means that the particular spot on the hard drive where the file was stored has simply been flagged as ‘okay to be overwritten’. The actual data (the 1’s and 0’s which compose the file) remains there unchanged until another file overwrites it, either in full, or partially. Formatting a drive is similar to deleting files, in that it does not overwrite any data, but it marks the entire drive as ‘okay to be overwritten’. This is why a disk erase utility which actively overwrites every single bit in the drive is needed to ensure data is irrevocably erased – it will change every bit of data rather than simply marking the existing data as okay to be overwritten by new data once needed.

There are hard drive disposal services that can provide you with a Certificate of Destruction, or if you choose to dispose of them yourself, there is a template by Doctors of BC to create your own Certificate of Destruction, which will ensure you have a record of when and how you disposed of the drives to ensure compliance with PIPA and PIPEDA.

Have questions?

Our Concierge is here to help you find the right information. Email concierge@vancouverdivision.com, attend his virtual office hours, or book a call with him for 1 on 1 assistance.