Are you risking HIPAA compliancy?

As support for Dragon Medical Practice Edition has ended, providers need to look hard at HIPAA compliance risk. Running unsupported dictation software is not just an IT inconvenience. It can create a real security exposure for a healthcare practice and the patients it serves.

Since the compliance date of the Privacy Rule in April 2003, OCR has received over 291,366 HIPAA complaints and has initiated over 1,107 compliance reviews. They have resolved ninety-six percent of these cases (281,022). OCR has investigated and resolved over 29,428 cases by requiring changes in privacy practices and corrective actions by, or providing technical assistance to, HIPAA covered entities and their business associates. Corrective actions obtained by OCR from these entities have resulted in change that is systemic and that affects all the individuals they serve. OCR has successfully enforced the HIPAA Rules by applying corrective measures in all cases where an investigation indicates noncompliance by the covered entity or their business associate. To date, OCR settled or imposed a civil money penalty in 106 cases resulting in a total dollar amount of $131,392,632.00.

The HIPAA Security Rule (45 C.F.R. 164.308(a)(5)(ii)(B)) requires that software used by Covered Entities or Business Associates be kept current with updates from the software vendor. If a vendor no longer supports a program, that software should not remain in production use. Unpatched vulnerabilities stay open when the manufacturer is no longer releasing fixes.

Dragon Medical Practice Edition 4 reached end-of-support on March 31, 2022. Providers still running it should plan to remove it. Older desktop versions keep large local files on workstations that were created from dictated text. Without ongoing vendor updates to protect those files, practices take on unnecessary risk of exposing protected health information. DMPE also does not work on Windows 11. Practices upgrading machines will lose a working dictation workflow unless they move to a supported product. The supported path forward is Dragon Medical One, which receives ongoing security and product updates as a cloud-based medical speech recognition platform.