Article
Who can remotely reach the gear in your practice?
Most practice owners I talk to can name who has a key to the front door. Ask who can reach a fridge controller, a patient monitor, a scanner, or a support tool over the network, and the answer is usually quieter. Somebody set it up years ago so a vendor could help without driving over. The account is still there. Nobody has looked at the list since.
I'm not writing this to scare anybody. I'm writing it because the path into your building's systems is often the same path a stranger would use, and the past couple of years have made that hard to ignore.
This isn't only about EHRs
In early November 2026, the French Blood Establishment said a cyberattack on a refrigeration service provider raised temperature and defrost thresholds to extremely high levels at three of its cold-storage sites. Monitoring and alarm systems flagged the change. Staff secured or moved the plasma. No blood products were lost, and collection and distribution continued. The blood service said it was not the direct target; its refrigeration supplier was. Coolworld, a refrigeration company named in reporting, said the issue involved remote monitoring software and a third-party component outside its direct control. (AP News; BleepingComputer, Nov. 4, 2026)
That was cold storage, not an EHR. Your office may not run a blood bank, but the pattern shows up in smaller form every week: a vaccine fridge with a cloud monitor, a building HVAC login, a lab analyzer with vendor remote support, a "we'll just leave TeamViewer running" shortcut on a front-desk PC.
Clinical gear can phone home too
In January 2025, the FDA warned that certain Contec CMS8000 patient monitors (and some Epsimed MN-120 units, which are the same monitor under another label) had cybersecurity problems once they were connected to the internet. CISA's analysis described a backdoor that reached a hard-coded external address, and said the device could leak patient and sensor data. The FDA later updated that notice after a vendor patch that removes networking so the monitor only works for local viewing. (FDA Safety Communication; CISA ICSMA-25-030-01)
You may never have bought a Contec by that name. The point is the same one the fridge story makes: if a device on your network can be reached or can reach out, treat that as part of your practice's attack surface, not as "the vendor's problem."
What I'd ask in a small office
You don't need a full industrial-control assessment. You need a short list written down on paper or in a shared note that isn't only inside one person's head:
- What has a remote path? Remote Desktop on a PC, WinRM, a vendor support tool (TeamViewer, AnyDesk, ScreenConnect, LogMeIn, Splashtop, and the rest), a cloud portal for a fridge or HVAC controller, a modem the vendor left behind.
- Who owns each path? Name of the vendor, the account they use, and who in your office can approve a session.
- Is it on only when needed? Always-on remote support is convenient. It's also a door that never closes. Prefer tools that wait for someone in the office to start a session.
- Does it need MFA? HHS's voluntary healthcare Cybersecurity Performance Goals list multifactor authentication as an essential goal for assets and accounts that are reachable from the internet, and they list vendor/supplier cybersecurity requirements as an essential goal too. (HHS: Cybersecurity Performance Goals)
- What happens when the contract ends? Old vendor accounts and leftover agents are common. If somebody stopped supporting you last year, their access should have stopped the same week.
A practical afternoon checklist
- Walk the office once. Note every fridge, analyzer, phone system, camera NVR, and "black box" with an Ethernet cable or a SIM card.
- On a couple of PCs, look for remote-support software in Installed Apps and in the system tray. If you see one you don't recognize, write it down before you remove anything.
- Ask your IT person for a short report of which PCs have Remote Desktop enabled and which accounts can use it.
- Call the two vendors you lean on most (EHR, billing, imaging, fridge monitoring) and ask: how do you connect, who can start a session, and how do we turn it off?
- Put the answers in one place. Review it when a staff member leaves and when you change vendors.
None of that requires buying new hardware. It does require an hour of attention before something else forces the issue.
Want a second set of eyes?
I'm Kevin Roper, and I run Roper IT Consulting out of Holly Springs, NC. I've been in IT for more than 25 years, most of it in healthcare. I do a fixed-price $750 healthcare IT security assessment for small practices and clinics. I'll look at remote access and vendor paths into your PCs and gear, along with backups, email security, accounts and the other common gaps, then give you a plain-English list of what to fix first. I work remotely with practices anywhere, and on-site around Raleigh and Wake County.
If you'd like to set one up, request a consultation at roperitconsulting.com.