Question: Our practice hasn’t updated its equipment in several years. We have many outdated medical and IT devices. Are these devices security liabilities? Vermont Subscriber Answer: Updating your medical and IT devices can be time consuming and expensive, but it’s a necessary component to protecting your organization and your patients. Phasing out older servers, platforms, and medical equipment can help streamline processes and improve your security. While the initial investment to the older systems and equipment may be paid off, there are plenty of liabilities lurking around the corner. Legacy medical devices that are no longer supported by the manufacturer will not receive security updates, which leaves unpatched holes wide open for malicious actors to gain access. The same can be said for servers, network devices, and computers. Internet-connected devices require regular updates to plug up security holes, so threat actors don’t enter your network and compromise your organization’s and your patients’ information. Updating the equipment and software may seem like a significant investment now, but it may not seem so harsh when you compare it to the fines and penalties associated with a data breach. IBM’s “Cost of a Data Breach 2022 report” found that the average total cost of a data breach in healthcare is $10.1 million — “the highest average data breach cost of any industry.”