Security — Do we need more than antivirus to protect patient data?

Yes. HIPAA's Security Rule requires layered technical safeguards — not just antivirus. That includes endpoint detection, encrypted communications, access controls, and audit logging. Antivirus alone does not satisfy your compliance obligations.