6 Places Unsupported Technology Hides in Senior Living

Unsupported technology is any computer, program or device whose maker has stopped sending security fixes. In a senior living community it most often hides in six places: front-desk and nurse station computers, the server in the closet, older office software, camera recorders, the equipment where the internet enters the building, and building systems like nurse call and door locks. It still works. It just no longer gets repaired when a weakness is found. This is part of our cybersecurity guide for senior living.

Why this matters this week

October 14, 2026 is the last day of Microsoft's paid extended security updates for Windows Server 2012 and 2012 R2, older versions of the software that runs many in-house servers. After that date there is no fix to buy for those servers at any price (Microsoft lifecycle page, checked October 2026). It is a good moment to ask what else in the building has quietly reached the same point.

The federal Cybersecurity and Infrastructure Security Agency (CISA) puts unsupported software first on its list of bad practices for organizations that support critical infrastructure, a group that includes healthcare. It calls the practice "especially egregious" in anything reachable from the internet (CISA, Bad Practices, checked October 2026).

1. Front-desk and nurse station computers still on Windows 10

Microsoft ended support for Windows 10 on October 14, 2025. Those computers still turn on and run your programs, but they stopped getting security fixes unless the organization pays for Microsoft's extended updates, which businesses can buy for up to three years (Microsoft, checked October 2026). The shared computers at the front desk and nurse station are the ones most likely to be older, and the ones most staff log in to.

What to ask: how many of our computers are still on Windows 10, and is each one enrolled in extended updates or scheduled for replacement?

2. The server in the closet

Many communities still have a server on site that holds shared files, runs an older program, or manages staff logins. Two dates matter. Windows Server 2012 and 2012 R2 lose their last paid updates on October 14, 2026. Windows Server 2016 reaches its end of support on January 13, 2027, three months from now (Microsoft lifecycle pages, checked October 2026).

What to ask: do we have a server on site, which version is it running, and when does that version stop getting fixes?

3. Older office software

Word, Excel and Outlook bought as a one-time purchase have end dates too. Office 2019 reached its end of support on October 14, 2025, and earlier versions ended before that (Microsoft lifecycle page, checked October 2026). Outlook is where fake emails arrive, so an unsupported copy of it matters more than its age suggests.

What to ask: is every computer on a supported version of Office, or a subscription that updates itself?

4. The box that records your cameras

Security cameras usually feed a recorder, a small box or computer that stores the footage. These often run for years after installation, and the manufacturer may stop updating them long before they stop recording. Because staff and families sometimes view footage from outside the building, some recorders are reachable from the internet, which is exactly the situation CISA singles out.

What to ask: who made our camera recorder, is it still getting updates, and can it be reached from outside the building?

5. The equipment where the internet enters the building

The firewall, the box that decides what traffic gets into your network, is the front door for every system you run. Firewalls and routers have end-of-support dates like everything else. An old one may still pass traffic perfectly well while no longer receiving fixes for the weaknesses attackers look for first.

What to ask: what make and model is our firewall, and is it still supported by its manufacturer?

6. Nurse call, door locks and other building systems

Nurse call, the door locks and badge readers, and similar building systems are often installed once and left in place for many years. They are usually managed by their own vendor rather than your IT provider, which means nobody may be tracking whether they still get updates. These are also the systems that touch resident safety most directly.

What to ask: for each building system, who is the vendor, and have they told us in writing when updates will stop?

What to do when you find one

Finding an unsupported system is not an emergency by itself. It is a decision to make on purpose. There are usually three options:

• Pay for extended updates where the manufacturer offers them, as Microsoft does for Windows 10.
• Separate it from everything else, so that if it is ever compromised it cannot reach resident records or other systems.
• Replace it on a date, with the cost on next year's budget. Our technology budget checklist has a line for exactly this.

The one choice that leaves the risk unmanaged is not knowing. If your community is covered by HIPAA, the required security risk analysis is where unsupported systems should be written down. And if your cyber insurance application asks about older systems, this list becomes your answer.

One question for leadership

Before approving next year's technology budget, ask your IT provider for one list: every computer, server and building system we run, and the date each one stops getting security fixes. If that list does not exist yet, making it is the first project. It also pairs well with knowing which outside companies can connect to those systems.

Frequently asked questions

What does it mean when technology is unsupported?

The company that made it has stopped sending security fixes. The computer or device still turns on and works, but new weaknesses found in it will not be repaired by the manufacturer.

Did Windows 10 stop working when support ended?

No. Microsoft ended support for Windows 10 on October 14, 2025. Those computers still work, but they no longer get security fixes unless the organization pays for Microsoft's extended updates, which are available to businesses for up to three years.

What if we cannot replace an unsupported system right away?

There are usually three options: pay for extended updates where the manufacturer offers them, separate the system from everything else so it cannot reach resident records, or put its replacement in next year's budget with a date. Doing nothing is the only option that leaves the risk unmanaged.