I looked into the HIPAA thing a little bit.
Microsoft says it's a "myth" that Windows 10 is not HIPAA compliant. All you have to do is buy "Windows 10 Enterprise" edition, lock it down, and disable many of its services.
http://www.hipaaone.com/whitepaper-hipaa-microsoft-windows/http://www.hipaaone.com/wp-content/uploads/2017/05/HIPAA-and-Win-10-FINAL-Updated-Appendix.pdfIf a medical facility utilizes voice-to-text technology (e.g. by saying “Hey Cortana”, “Siri” “OK Google”, or “Alexa”) to dictate notes about a patient, that information is automatically exchanged with the cloud. Without a business associate agreement, that medical facility could face a HIPAA violation.
This is phrased so it's misleading. That medical facility
could face a HIPAA violation sure, but the fact is they
have committed a separate HIPAA violation every single time they talk about patients near a computer with Cortana active (and even if think you disabled it it's often still running). Furthermore, these are clearly cases of willful neglect so the fine is
$50,000 per violation with an annual maximum of $1.5 million.
A common misconception in the industry is that using Windows 10 opens an organization to HIPAA violations. The truth is Windows 10 can be easily configured to support HIPAA security and privacy requirements. This whitepaper outlines such configurations...
Based on hearing it from the horse's mouth, it sounds
to me like Windows 10 is
not HIPAA compliant at all out of the box, and therefore that's not a myth. Further, based on what I understand of it, Windows Home, bundled with most cheap computers, definitely can not be made compliant either since you're not allowed to turn a bunch of the stuff off in Home edition. The site and white paper talk about Windows 10 in a generic sense but when they get specific about changes needed they start talking about this "Windows Enterprise Edition" thing. They carefully avoid claims about Home and Pro editions, whether those can be made compliant at all.
edit:
"Cortana management" is only available in the Enterprise Edition. So Home or Pro, and Enterprise default settings, are not acceptable for use in a facility that handles medical data.
Also of interest, only the top of the line Enterprise E5 Edition has "Windows Defender Advanced Threat Protection" (
ATP).
It appears that Enterprise requires either a negotiated volume licensing contract for an agency, as with US government agencies, or a signed contract and a monthly subscription fee. In other words, if you don't have the personal phone number of the "Microsoft Partner" assigned to handle your account, a guy who lives in your region and makes on site license compliance visits, then you're the product and Microsoft is harvesting your privacy for profit.
There's also an Education edition, which appears to be totally identical to the Enterprise one but has a different pricing structure and is only available to schools. Because of laws regarding the privacy of minors it seems it was also necessary to be able to disable Cortana (and related features such as where everything you type is analyzed and send to Microsoft for use in a "personal dictionary", claimed to be necessary for Cortana to work right) in order to use Windows 10 legally in a school.
Enterprise E3 costs $199 for a Pro license plus $300 for the E3 upgrade = $499 per computer, then (or is it or) $84 per user per year. Or maybe it costs something different. Here's an estimator app that attempts to tell you how much it will cost:
http://mla.microsoft.com/