Most practices have one: a server in a back closet or under the front desk, running the EHR or practice-management database everyone depends on. Nobody’s touched it in years. It just works.
That’s the risk. If it runs SQL Server 2016 or Windows Server 2016, it has reached end of support (July 14) or soon will (January 12), and without paid extended updates, every new security hole stays open on the machine holding your patient records.
What’s actually happening in 2026
SQL Server 2016 reached end of support on July 14, 2026, and Windows Server 2016 reaches end of support on January 12, 2027, according to Microsoft’s lifecycle pages. After those dates, Microsoft stops releasing regular security updates for either product unless you pay for Extended Security Updates (ESUs).
End of support is the date a vendor stops fixing a product: the software keeps running, but flaws discovered later stay unpatched.
Microsoft calls ESUs a “temporary bridge.” SQL Server 2016 ESUs cover only Critical flaws, end in July 2029 and aren’t sold for the Express edition. Windows Server 2016 ESUs deliver Critical and Important fixes through 2030 for Standard and Datacenter editions, and on-premises servers need Software Assurance or an equivalent subscription.
Hacking drives most large health data breaches: HIPAA Journal’s H1 2026 report (September 30, 2026) counted 343 hacking/IT incidents among 397 breaches affecting 500 or more people.
Why this is a HIPAA problem, not just an IT problem
HIPAA never says “run supported software.” It does require an accurate and thorough risk analysis and security measures that reduce risks to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)(A) and (B)). An unpatchable server is a known vulnerability, so it belongs in that analysis with a dated plan, like the X-ray sensor still running Windows XP.
On July 29, 2026, HHS OCR announced a $552,250 settlement with OSF HealthCare, its 21st ransomware enforcement action, citing a potential failure to conduct an accurate and thorough risk analysis. Attackers took the PHI of 53,907 people, and OCR cited late breach notices too; the Breach Notification Rule requires notice without unreasonable delay and within 60 days of discovery.
Moving the EHR to a hosted provider? That host is a business associate and must sign a business associate agreement (BAA).
A January 2025 OCR proposal would require a written technology asset inventory and patching of critical risks within 15 days, but it’s still only proposed: GovInfoSecurity reported on July 8, 2026 that final action isn’t planned before July 2027.
What to actually do about it
Start by knowing what you’re running, then put a date on the fix.
- Inventory every server’s versions and editions: SQL Server 2016 shows as version 13.x, and the edition decides your options, since SQL Server Express can’t get ESUs.
- Get your vendors’ answers in writing: which versions your EHR and imaging software support and whether hosting is offered, so the upgrade path is on record.
- Add each unsupported system to your HIPAA risk assessment: note its end date, the PHI it holds and a fix deadline, because OCR keeps citing missing or inaccurate risk analyses.
- Price the options side by side: an upgrade, a hosted EHR and ESUs all cost money, but ESUs only buy time; see what managed IT costs for a medical practice.
- Fence it off until it’s replaced: limit which computers can reach it, keep email and browsing off it, and never expose remote desktop to the internet, so one weak spot can’t spread.
Where ACS fits in
ACS’s free 30-minute IT & HIPAA assessment checks which Windows Server and SQL Server versions you run, flags anything past or near end of support, and shows where an upgrade, hosting or ESUs fit. If nobody tracks patching month to month, that’s the gap managed IT for medical practices closes.
