Software Patching as a HIPAA Requirement: A guide to OCRs Expectations for Software Updates
Executive Summary
While the HIPAA Security Rule does not explicitly mention "software patching" or "updates," the HHS Office for Civil Rights (OCR) has established through enforcement actions that maintaining current, supported software is a required component of HIPAA compliance. The 2014 Anchorage Community Mental Health Services (ACMHS) settlement serves as the definitive precedent, with OCR explicitly citing the failure to apply patches as a Security Rule violation resulting in a $150,000 penalty.
