7 Cybersecurity Checks Senior Living Leaders Can Run This Week

October is Cybersecurity Awareness Month. A senior living director does not need a technical background to find out where the community stands. Seven questions cover most of it: which accounts open with just a password, how logins start and stop with staff, whether people sign in as themselves, which outside companies can log in, which systems no longer get security fixes, whether staff would report a mistake, and what your vendors owe you when something goes wrong. Each one is a question for your team or your IT provider. This list is part of our cybersecurity guide for senior living.

How to use this list

Do not try all seven at once. Pick one, ask it this week, and write down the answer and the name of the person who gave it. A written answer is worth more than a confident one, because you can check it again next year and show it to an auditor, an insurer or a new owner.

None of these questions accuses anyone. A good IT provider and a good vendor will have answers ready. When an answer is "I'm not sure," that is useful too: it tells you where to look next.

1. Which accounts still open with just a password?

A password alone can be guessed, reused from another site or handed over to a fake email. Many systems can also ask for a second step, such as a code on a phone or an app that asks "is this you?" Email, the charting system, payroll and banking are the accounts where that second step matters most. Some cyber insurers now ask about it on renewal applications; our post on what insurers are asking for explains the change.

What to ask: which of our important accounts still open with only a password?

2. When someone starts or leaves, who handles their logins, and how fast?

Senior living hires all year. When a new hire's own login is not ready on day one, someone usually lends theirs, and the records carry the wrong name from then on. When someone leaves, a login that is never shut off can keep working for months. Both are a timing problem, not a technical one: the person who sets up logins needs to hear from HR the day a start or end date is set.

What to ask: who sets up and shuts off logins, how do they find out, and how long does it usually take?

3. Does everyone at the nurse station log in as themselves?

Charting systems keep a history of who opened and changed each record. That history only means something if each person signs in with their own login. A shared login at a busy station puts one name on everything. Our post on records that matter when staff report a concern explains why that history can matter later.

What to ask: are there any shared computers where staff use one login between them?

4. Which outside companies can log in to your computers?

Your IT provider, your charting vendor, the company that installed the door system, the phone vendor: many of them can connect to your systems from their own office to fix problems. That is normal and useful. It also means each of those connections needs an owner on your side, and some of those companies may need a written agreement if they can see resident information. Our guide to business associate agreements covers which vendors usually need one.

What to ask: who can connect to our systems from outside the building, and is anyone on the list who no longer works with us?

5. Which systems have stopped getting security fixes?

Software and equipment makers stop sending security fixes for older products after a while. A computer, camera recorder or building system can keep working for years after that, with no warning on the screen. Our list of six places unsupported technology hides walks through where to look and what to do when replacing something is not in this year's budget.

What to ask: do we have a list of our systems with the date each one stops getting fixes?

6. If a staff member clicked a fake link, would they tell you?

Fake emails are written to fool careful people, and some now use AI to sound like someone you know. The difference between a small problem and a large one is often how quickly someone says "I think I clicked something." That depends less on training slides than on whether staff believe they will be thanked, not blamed. Our posts on training senior living staff and AI impersonation scams go further.

What to ask: does every staff member know who to tell, and have we said out loud that reporting a click is the right thing to do?

7. If a vendor had a problem, what would they owe you, and how fast?

More of a community's software now runs on the vendor's computers instead of yours. If that vendor goes down or has a security problem, your contract and their answers decide how quickly you hear about it, how your staff keep working, and whether you can still reach a copy of your records. Our post on keeping resident records reachable during an outage lists the questions to ask before renewal.

What to ask: for our most important vendors, how would they tell us about a problem, and how would we keep working?

One more: who makes the first calls?

If the computers stopped tomorrow morning, one person should already know it is their job to make the first calls, with the numbers written on paper: your IT provider's after-hours line, your cyber insurance claims line, and the owner or leader who makes decisions. Your insurance policy may say who to call first and how quickly, so read that page before you need it. Our guide on what to do after a data breach covers the days that follow.

Frequently asked questions

Do I need a technical background to run these checks?

No. Each check is a question for your team or your IT provider. Your job is to ask it, write down the answer and notice when the answer is "I'm not sure."

Which check should we start with?

Start with whichever one you cannot answer today. For many communities that is the list of outside companies that can log in, or the list of systems that no longer get security fixes, because nobody has written either one down.

How often should we repeat these checks?

Once a year is a reasonable rhythm for the full list, and October is an easy month to remember. Logins for staff who start and leave should be checked every time it happens.