Article
Is antivirus actually running on every PC in your practice?
Ask a small office whether they have antivirus and the answer is almost always yes. Ask whether it's turned on, up to date, and scanning everything on every PC today, and the honest answer is usually "I think so."
That gap matters. Windows comes with Microsoft Defender built in, and a lot of practices also pay for another product. Either one only helps if it's actually running. Ransomware crews know that, which is why switching antivirus off is one of the first things they try.
Attackers go after the antivirus first
CISA's advisory on Hive ransomware, a group that went especially hard after healthcare, says that before encrypting anything, Hive removed virus definitions and disabled all parts of Windows Defender and other common antivirus programs through the registry. (CISA AA22-321A)
The Medusa ransomware advisory, which CISA updated in August 2026, says the healthcare and public health sector has been a frequent Medusa victim. It describes the attackers disabling Windows Defender through local Group Policy while they stole credentials, then turning it back on when they were done. It also says they placed their tools in folders that Defender had already been told to skip. (CISA AA25-071A)
That last part is the one I'd underline. Nobody had to break anything. A folder exclusion that someone added, probably for a good reason at the time, gave them a place to hide.
What "antivirus is on" really means
When I check a PC, I'm looking at five things, and none of them needs new software:
- Real-time protection is on. This is the part that stops a bad file when it lands. If Defender says it's in passive mode, some other antivirus is supposed to be doing that job. Make sure it really is.
- Signatures are current. Defender normally updates its signatures at least once a day. If a PC is a week behind, it usually can't reach Windows Update, and it's missing whatever came out since. CISA's healthcare ransomware guidance says to set antivirus to update automatically and run regular scans. (CISA AA20-302A)
- Tamper Protection is on. This Defender setting stops programs on the PC, including malware running as an admin, from turning protection off. CISA tells defenders to make sure it's enabled, and also points out that it doesn't stop someone from adding exclusions. (CISA CM0095)
- Exclusions are short and specific. An EHR or imaging vendor may ask you to exclude a data folder for performance. That's normal. A whole drive, the Downloads folder, every .exe file, or powershell.exe is not a small ask, and it should have a name and a reason next to it.
- The Windows Firewall is on for every profile. The Public profile is the one a laptop uses on hotel and home networks, so it matters most for anything that leaves the building.
Where this fits for a practice
The HIPAA Security Rule lists "protection from malicious software" as an addressable implementation specification: procedures for guarding against, detecting, and reporting malicious software. (45 CFR 164.308(a)(5)) HHS's Health Industry Cybersecurity Practices (HICP) lists endpoint protection as the second of its ten practices, and its volume for small organizations covers basic endpoint protection controls. (HHS 405(d) HICP Technical Volume 1)
I'm not a lawyer, and none of this is compliance advice. The practical point is simpler: if a PC touches patient data, you should be able to show that its antivirus is on and current, not just that you bought a license.
A 15-minute check you can do today
- On a front-desk PC, open Windows Security, then Virus & threat protection. Note whether real-time protection is on and when protection updates were last checked.
- On the same screen, open Manage settings. Check that Tamper Protection is on.
- Under Exclusions, write down every entry. For each one, ask who added it and why. If nobody knows, flag it for your IT person.
- Open Firewall & network protection and confirm Domain, Private and Public all say the firewall is on.
- Do the same on a laptop that leaves the building, and on the PC that runs your EHR or imaging software.
If you have more than a few PCs, ask your IT person or managed service provider for a one-page report covering all of them. They should be able to produce it from their antivirus console in a few minutes. If they can't, that's useful to know too.
Want a second set of eyes?
I'm Kevin Roper, and I run Roper IT Consulting out of Holly Springs, NC. I've been in IT for more than 25 years, most of it in healthcare. I do a fixed-price $750 healthcare IT security assessment for small practices and clinics. I'll check whether antivirus, Tamper Protection and the firewall are really on across your PCs and look at your exclusions, along with backups, email security, remote access, accounts and the other common gaps. Then I'll give you a plain-English list of what to fix first. I work remotely with practices anywhere, and on-site around Raleigh and Wake County.
If you'd like to set one up, request a consultation at roperitconsulting.com.