Either they are paying to get esu patching past eol or they are on newer oses. The cost of HIPPA infractions like that is astronomical and impossible to avoid. If you know for a fact you saw an eol os, they are paying per year per device for extended patching.