Our practice software vendor says not to update Windows. What do you do with that?

That instruction is usually shorthand for something narrower than it sounds. What the vendor generally means is that they have not yet certified the latest major Windows feature release, which is a fair position. What they almost never mean is that you should stop applying security patches, though that is how practices interpret it, and we have walked into offices that had not been patched in two years because of a sentence in a vendor email.

How we handle it: security updates continue, tested on one machine first rather than pushed to all eight operatories at once. Feature updates are held until the vendor certifies them, then scheduled outside patient hours. If something breaks, we can roll it back, which is a different conversation from never updating at all.

Where a vendor genuinely requires an operating system that is no longer supported, usually on an imaging workstation, we isolate that machine on the network so it cannot be reached from everywhere and cannot reach everything. That is a real control rather than a hope, and it is also what an auditor expects to see documented.