Walk the halls of a modern care facility and count the connected devices: vital signs monitors, infusion pumps, nurse call, cameras, door controllers, thermostats, wireless phones, smart TVs, label printers. Each one is a computer, and many run old software that cannot be patched easily. If they all sit on the same flat network as your EHR workstations and file server, a compromise of any one device can become a path to everything else.
Network segmentation is the practice of dividing a network into zones and controlling traffic between them. It does not require exotic technology, but it does require planning.
On a flat network, any device can talk to any other device. An attacker who takes over a camera or a printer can scan the network, find servers and move toward valuable data. Segmentation puts walls inside the building so that a problem in one zone is contained.
It also helps availability. A malfunctioning device broadcasting noise on the network can slow down clinical systems if they share the same segment.
A practical design might include:
Clinical workstations and servers: staff computers, EHR access, file servers
Medical devices: monitors, pumps, point-of-care testing equipment
Building systems: cameras, door access, HVAC and lighting controllers
Nurse call and communications: call systems, wireless phones, overhead paging
Management network: switches, firewalls and wireless controllers
Not every facility needs every zone, but even three or four make a major difference.
Virtual LANs separate traffic on the same physical switches. A firewall or router with rules then controls which zones can talk to each other. The key principle is default deny: block everything between zones, then allow only specific traffic that is needed.
Map each wireless network name to the appropriate segment so that a resident's phone never lands on the same network as a medication cart.
Where possible, restrict which devices can plug into wired ports and detect unfamiliar devices that appear on the network.
Inventory devices. You cannot protect what you cannot see. Scan the network and walk the building, including closets and mechanical rooms.
Learn what talks to what. Ask vendors which servers, ports and cloud services each device requires.
Design zones and rules. Start with a simple plan and document it.
Pilot with low-risk devices. Move cameras or printers first and watch for problems.
Move clinical devices carefully. Coordinate with clinical engineering and the vendor, and schedule changes when they will not interrupt care.
Monitor and adjust. Review logs for blocked traffic that shows a legitimate need.
Some devices run unsupported operating systems and cannot be updated. Isolation is often the best protection available.
Always involve the manufacturer, since incorrect changes may affect warranty or safety.
Keep a record of the device, the vendor contact and any known vulnerabilities.
Ask vendors about their security support when buying new equipment.
Creating segments but allowing all traffic between them
Leaving old vendor firewall rules in place indefinitely
Forgetting to segment guest and resident Wi-Fi
Changing network settings without telling clinical staff who rely on devices
Leaving default passwords on switches, cameras and controllers
The HIPAA Security Rule expects reasonable safeguards for the confidentiality, integrity and availability of ePHI. Segmentation is a widely recommended control, and the HHS 405(d) Health Industry Cybersecurity Practices include guidance on network management and medical device security. It also reduces the scope of an incident, which can simplify your breach risk assessment.
Segmentation projects often fit well alongside a switch or firewall refresh. If you are planning hardware changes, bring segmentation into the design early. UnityCare IT can help inventory your connected devices, design zones that match your facility and carry out the changes with minimal disruption.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172