A modern care facility's network carries far more than computers. Smart thermostats, door access controls, security cameras, wandering-resident systems, medication dispensing equipment, telehealth carts and the nurse call system may all share the same wiring as the business office. Many of these devices cannot run security software, rarely receive updates and may run for a decade with the same settings.
If all of them sit on one flat network, a problem with one device can become a problem for everything. Network segmentation is the practice of dividing a network into zones so that trouble in one area does not freely spread to others.
Imagine a building with a locked door between every wing. A visitor who gets into the lobby cannot automatically walk into the medication room. Segmentation applies the same idea to data. Devices are grouped into separate zones, often called VLANs, and a firewall or similar device controls what traffic may pass between them.
Limits the spread of attacks. If ransomware lands on an office computer, segmentation can stop it from reaching clinical systems or building controls.
Protects devices that cannot protect themselves. Older equipment can be isolated and given only the access it needs.
Supports HIPAA safeguards. The Security Rule expects access controls and protection of electronic protected health information, and segmentation is a practical, widely recommended way to help meet these expectations.
Improves performance. Heavy traffic such as camera video can be kept from slowing charting.
Makes problems easier to find. Smaller zones are easier to monitor.
The right design depends on your building, but a typical facility might create these zones:
Staff and clinical workstations that access the EHR and business applications
Servers and critical systems, with tight rules about who can connect
Medical and monitoring devices, including anything that stores or sends resident data
Building systems, such as HVAC, door controls and cameras
Voice systems, so phone traffic can be prioritized
Guest and resident Wi-Fi, completely isolated from internal systems
Management network for administering switches and firewalls, available only to IT
You cannot segment what you cannot see. Build an inventory of every networked device, its purpose, vendor and the kind of traffic it needs. Network scanning tools can help find forgotten devices.
Many device manufacturers publish the ports and destinations their equipment requires. Ask for this in writing. Some vendors also need remote access for support, which should be through a controlled, logged method and not an always-open connection.
Start with a default of denying traffic between zones, then allow only what is necessary. For example, the nurse call server may need to reach its handsets and a specific vendor update site, but not the business office printers.
Segmenting a live care facility must be done carefully so care systems are not interrupted. Begin with the least critical zones, such as guest Wi-Fi and cameras, then move toward clinical systems. Test each change and keep a rollback plan.
Log traffic between zones and review blocked connections. Unexpected attempts can reveal both misconfigured devices and real threats. Revisit the rules at least annually and whenever new equipment is added.
Creating zones but allowing everything between them. That offers little protection.
Forgetting vendor remote access. Permanent open tunnels are a common weak point.
Skipping documentation. Without a diagram and a rule list, the design will drift.
Underestimating equipment. Inexpensive switches and firewalls may not handle inter-zone traffic at needed speeds.
Treating it as a one-time project. New devices appear constantly.
Which devices on our network are medical or building systems?
Are they separated from the staff network?
Who has remote access to them and how is it controlled?
Can we see a current network diagram?
Segmentation is one of the most effective improvements a facility can make, and it is usually achievable without replacing everything. UnityCare IT designs and implements segmented networks for long-term care, assisted living and clinic environments, working around the schedule of care. If you are unsure what is connected to your network today, we can start with a discovery and a simple diagram.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: 2524 N Broadway Ste 554 PMB 947974, Edmond, Oklahoma 73034