On a flat network, every device can talk to every other device. That means a resident's tablet, a smart thermostat, a nurse station computer and the server holding your electronic health record all sit in the same neighborhood. If one is compromised, the attacker can often reach the rest.
Network segmentation divides that single neighborhood into separate zones with controlled doors between them. It is one of the most effective and least glamorous improvements a care facility can make.
The building blocks are straightforward.
A virtual local area network, or VLAN, lets one physical switch behave like several separate ones. Devices in different VLANs cannot talk directly to each other without passing through a router or firewall.
The firewall is the doorkeeper between zones. You decide which traffic is permitted, such as nurse station computers reaching the EHR, and which is blocked, such as guest devices reaching anything internal.
Each wireless network name can be tied to a VLAN, so devices joining the guest Wi-Fi land in the guest zone automatically.
Ransomware often spreads sideways from one computer to others. Segmentation slows or stops that.
Older medical devices and building systems often cannot be patched. Isolating them reduces the harm from known weaknesses.
Resident and guest devices are unmanaged and unpredictable, so they should never share a network with clinical systems.
HIPAA's Security Rule expects access controls and protections for electronic protected health information, and segmentation supports both.
Most facilities can start with five or six zones.
Clinical and administrative workstations. Staff computers that use the EHR and business applications.
Servers and critical systems. Anything holding data, with the tightest access rules.
Medical and clinical devices. Vital signs equipment, networked scales and similar devices.
Building and security systems. Cameras, door controls, thermostats, nurse call and lighting.
Resident and guest Wi-Fi. Internet access only.
Management network. Switches, access points and firewalls, accessible only by IT.
Some facilities also add a zone for phones and another for printers.
Start by blocking traffic between zones, then allow only what is needed. It is easier to add a rule when something breaks than to discover which unnecessary paths were left open.
Keep a diagram showing each zone, what lives in it and which rules connect them. Without a diagram, changes become guesswork and mistakes creep in.
Many building and device vendors want remote access. Provide a controlled, logged and time-limited way in, rather than leaving a permanent open connection.
Segmenting a live network without planning can cause outages. A safer approach:
Inventory the devices on your network and what each needs to talk to
Choose a low-risk zone to start, such as guest Wi-Fi
Move devices in small groups, ideally outside peak charting hours
Test critical workflows, such as medication carts reaching the EHR, after every change
Keep a rollback plan for each step
Segmentation requires managed switches and a firewall that supports multiple zones. Many facilities already own capable hardware that is simply set up as one flat network. Check before buying anything new. Also confirm that old, unmanaged switches in closets are not quietly bridging zones.
Review firewall rules at least twice a year and remove ones that no longer apply. Watch for unknown devices appearing in sensitive zones. Network access control tools can automatically place new devices into the right zone, though they are not required for a smaller facility.
Allowing broad any-to-any rules to quiet complaints
Forgetting printers and copiers that staff must reach from several zones
Leaving default passwords on switches and firewalls
Segmenting once and never revisiting after new equipment arrives
UnityCare IT designs and implements segmented networks for long-term care and senior living facilities, and we can begin by mapping what is on your network today and proposing zones that fit your building and budget.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172