Is the reception PC the weak link in your medical practice?
Often, yes. The reception PC opens emails and attachments from outside, stays on all day in front of patients and gives access to patient records. It is the easiest way in for a stolen password or malware. A few simple steps make a big difference: one account per person without administrator rights, a screen that locks itself, automatic updates and a clear rule for when a message or a web page looks odd.
Why reception is the most exposed door
The reception PC does everything at once. It runs the diary, reads patients' ID cards, opens emails from labs, health insurance funds and suppliers, prints, scans, and is often used to look up a phone number online. It stays on all day, sometimes with a single login for the whole team, on a desk that patients can see up close.
For an attacker, it is the ideal machine: lots of messages from outside, several people taking turns at it, little time to think between two patients, and direct access to the patient records software. One click in the wrong place can open the door to the whole practice.
| What the reception PC does | The risk | The simple step |
|---|---|---|
| Opens emails and attachments from outside | Fake message, booby-trapped link, stolen password | Multi-factor authentication on email and an ‘if in doubt, ask’ rule |
| One login for the whole team | Password known to everyone, no way of knowing who did what | One account per person |
| Stays unlocked when reception steps away | A patient sees someone else's appointments or file | Automatic lock and the Windows + L habit |
| Screen and USB ports within reach of the public | Reading over the shoulder, a USB stick plugged in on the quiet | Screen turned away, computer tower out of reach |
| Account with administrator rights | Malware installs without hitting any obstacle | A standard account for everyday work |
| An old Windows version or overdue updates | Known flaws, exploited within days | Automatic updates, a system Microsoft still supports |
What the figures say in Belgium
The Centre for Cybersecurity Belgium (CCB) published its review of 2025 in March 2026. Three figures matter directly for a practice's reception desk:
- 144 hacked accounts: the type of incident most often reported to the CCB in 2025, mainly because of stolen login details.
- Nearly 10 million suspicious messages forwarded to Safeonweb in 2025, according to the CCB's key figures. Phishing (the fake message that pushes you to click or give away a password) remains one of the most common ways in.
- Five days: on average, the time between a software flaw being announced and attackers exploiting it. Nearly a third of flaws were exploited in under 24 hours.
The CCB also describes a trick that is spreading fast: getting the user to run a malicious command themselves. The attacker no longer needs to force the door; the person at the screen opens it, in good faith. The same review counts 105 ransomware attacks (a program that locks files and demands a ransom) in 2025.
How one click at reception becomes the whole practice's problem
Example, made up for illustration. A Tuesday morning, at the reception desk of a fictional group practice. What happened:
- The receptionist looks up a lab's phone number online.
- The website shows a fake ‘Verify you are not a robot’ box, then asks her to press three key combinations to ‘complete the check’. Nothing happens on screen.
- In fact, the page had secretly copied a command, and those keys ran it. Microsoft describes this technique, known as ClickFix: the program it installs is often a password stealer.
- The login details for the practice's email, saved in the browser, go with it.
Two things would have changed the story: a rule the whole team knows (no real website asks you to press keys on your keyboard to prove you are human) and multi-factor authentication on email, which makes a stolen password harder to use.
Eight steps that protect reception
1. One account per person, without administrator rights
Everyone at reception has their own username and password, on the PC and in the patient records software. You know who looked at what, and when someone leaves, you only need to close one account.
Administrator rights (the ones that let you install software and change settings) stay with the person who manages IT. The Small level of the CyberFundamentals, the CCB's reference framework for small organisations, says it clearly: nobody should have these privileges for day-to-day tasks.
2. A screen that locks itself
The PC locks automatically after a few minutes without activity. And the team gets into the habit of locking it themselves when they get up: Windows key + L. It takes a second, and a patient can no longer read someone else's appointments or file.
3. A reception desk designed for discretion
The CyberFundamentals framework asks you to protect computers physically against theft and misuse. At reception, that means:
- A screen turned so it cannot be read from the desk or the queue, or a privacy filter.
- A computer tower and USB ports out of reach of patients and the people with them.
4. Automatic updates, on a Windows version that is still supported
The CCB recommends installing security updates as soon as they are available, and making them automatic. With flaws exploited in five days on average, waiting for ‘a quiet moment’ is no longer a good idea.
Check the Windows version too. Support for Windows 10 ended on 14 October 2025. Without the paid Extended Security Updates (ESU) subscription, which an organisation buys a year at a time and for three years at most, the PC no longer gets any fixes. The reception PC, often the oldest in the practice, is the first one to check.
5. Up-to-date antivirus and no unknown USB sticks
- Up-to-date antivirus on every device, including the reception PC.
- No unknown USB sticks, as the CyberFundamentals framework requires: not a patient's, not one found in the waiting room.
- Patient documents brought in on a stick: agree with your IT provider to read them on a separate computer, after a scan.
6. Multi-factor authentication on email
Multi-factor authentication asks for a confirmation on your phone on top of the password. The CCB recommends it wherever possible, and always for remote access. For reception, start with the mailbox: hacked accounts are the most reported incident in Belgium.
7. A PC for the practice, and nothing else
Not on the reception PC:
- personal email;
- social media;
- software downloaded ‘as a quick fix’.
Every extra use is another door. The CyberFundamentals framework advises installing only the software the organisation needs to run.
8. Rules on the wall and a paper sheet
The CCB advises keeping offline, on paper for example, who to contact if there is an incident and what information to give them. Put this sheet up next to the PC, with three simple rules:
- An unexpected message that rushes you (an invoice, a parcel, an ‘expired’ password): don't click, ask.
- A page that asks you to press keys on the keyboard or paste something: close the page.
- Second thoughts afterwards: speak up straight away. A quick alert is better than an awkward silence.
The ten-minute reception check-up
Go through it with the person on reception. A single answer that differs from the expected one is enough to put that point at the top of this week's list.
| Question | Expected answer |
|---|---|
| Does everyone at reception have their own account? | Yes |
| Does the everyday account have administrator rights? | No |
| Does the screen lock itself after a few minutes? | Yes |
| Can a patient at the desk read the screen? | No |
| Can the USB ports be reached from the waiting room? | No |
| Does Windows still receive security updates? | Yes |
| Do updates install automatically? | Yes |
| Does email ask for multi-factor authentication? | Yes |
| Is the number to call if something goes wrong on display? | Yes |
If someone clicked
Don't panic, but don't wait either. In this order:
- Isolate the PC: unplug the network cable or turn off Wi-Fi. Don't switch it off: your IT provider will need it to work out what happened.
- Tell someone straight away: the person or provider who looks after your IT.
- Change the passwords for the affected account from another device you trust, starting with email.
- Report it: forward a suspicious message to [email protected], and an incident can be reported to the CCB.
- Think of patient data: if it may have been seen or copied, the practice must as a rule notify the Data Protection Authority within 72 hours of becoming aware of it, through its portal.
Get your reception PC checked→
Frequently asked questions
Do we need a new PC for reception?
Not necessarily. You need a PC that still gets security updates. Support for Windows 10 ended on 14 October 2025: a PC still on Windows 10, without an Extended Security Updates subscription, should move to Windows 11 if it is compatible, or be replaced.
One login for the whole reception team: is that really a problem?
Yes. The password ends up known to everyone, it never changes, and nobody can say who viewed or changed a file. With one account per person, a departure is handled by closing one account, and an incident is much easier to trace.
How quickly should the screen lock?
There is no set time. At reception, where patients are constantly walking past the screen, a few minutes is enough. The most effective step is still the Windows + L habit as soon as you get up.
What should we do with a suspicious email that arrives at reception?
Don't click, don't open the attachment, don't reply. Forward it to [email protected], then delete it. If someone has already clicked or typed a password, tell the person who manages IT straight away.
Does an incident on the reception PC have to be reported?
If patient data may have been seen, copied or lost, the practice must as a rule notify the Data Protection Authority within 72 hours of becoming aware of it, unless the breach poses no risk to the people concerned. Health data is sensitive, so if in doubt, get help to assess it.