[pageld]

The key phrase is "my team would interpret it."

Everyone interprets HIPAA differently and based on a statement like: "Continuing to use Windows XP after 4/8/14 (or other unsupported operating systems) becomes a HIPAA violation if it’s not addressed in your security risk analysis[0]." You can run XP indefinitely as long as your IT says it's OK and they've "secured it properly." However, if they do get hacked or whatnot, they can get a fine if their security analysis wasn't good enough.

I don't recommend it. I actually despise it and try my hardest to get people to drop it. But in the end, I've had to deal with a lot of XP running IE8 systems that need connections to the software I'm in charge of. There's nothing I can do unless I get rid of those users and most of the time I can't because I have to "support modern browsers" as noted in the contract and the contract is with the state, not the individual users. Yes, the contracts will get updated to be more specific, but most of the contracts are on 5 year cycles.

State .gov contract work is amazing. /s

[0] https://pimsyehr.com/resources/compliance/hippa-compliance/2...