Picture a nursing home where the nurse call system, security cameras, resident Wi-Fi, business office computers and the EHR all share a single flat network. Any one of those devices can, in principle, talk to any other. If a resident's tablet is infected, or a camera has a known weakness, an attacker may have a path toward systems that hold protected health information.
Network segmentation fixes that by dividing the network into zones with controlled traffic between them. This post explains the idea in plain terms and shows how to plan it.
A flat network is like a building with no interior doors, where anyone who enters the lobby can walk into any apartment. Segmentation adds doors and locks. People can still move between areas that need to connect, such as the kitchen and dining room, but they cannot wander into places they have no reason to visit.
Staff and administrative: business office, administrator, human resources
Clinical: nursing stations, EHR access, medication carts, therapy
Servers and infrastructure: on-premises servers, backup devices, management consoles
Medical and building devices: nurse call, cameras, door access, HVAC, thermostats, elevators
Resident Wi-Fi: personal devices, televisions and streaming sticks
Guest Wi-Fi: visitors and vendors
Voice: phone systems
The exact list depends on your building, but the principle is the same: group devices by purpose and risk, then control what crosses between groups.
Virtual local area networks separate traffic on the same physical switches into logical groups. Each zone gets its own VLAN and address range.
Traffic between VLANs passes through a firewall or a layer 3 device that applies rules. A good starting rule is deny by default, then allow only what is required. For example, resident Wi-Fi should reach the internet but not any internal system. Cameras may need to reach a recorder and nothing else.
Each wireless network name should map to a specific VLAN. Staff networks should require strong authentication, and resident or guest networks should be isolated from each other as well as from internal systems.
Containment: if ransomware lands on one workstation, segmentation can slow or stop its spread
Protecting unpatchable devices: older medical, camera or building devices that cannot be updated can be isolated so they are not reachable from risky areas
Reduced exposure: servers and backup systems can be placed where only a small set of devices can reach them
Better monitoring: with defined zones, unusual traffic stands out
Segmentation also supports the HIPAA Security Rule's requirement for access controls and risk management, and proposals to update the rule have discussed segmentation explicitly.
Inventory devices and group them by function.
Map which groups truly need to talk to each other, and over which ports.
Choose address ranges and VLAN numbers, and document them.
Confirm that switches and firewalls support the design, and that wireless controllers can map networks to VLANs.
Build rules in a test or monitoring mode first, then enforce.
Move devices in phases, starting with the lowest-risk groups, and keep a rollback plan.
Document the final design on a simple diagram.
Moving the nurse call system or a medical device without checking vendor requirements. Some devices need specific connectivity, so involve the vendor
Creating rules that are so broad they defeat the purpose, such as allow any between zones
Forgetting printers, which both staff and clinical areas often need to reach
Neglecting documentation, which makes troubleshooting harder
Doing the whole change on a busy weekday
Even a basic split between staff devices, building and camera systems, and resident Wi-Fi delivers meaningful benefit. UnityCare IT designs and implements segmented networks for healthcare and senior-living facilities, coordinating with your vendors to avoid disruptions. If your network has never been segmented, we can start with a simple map and a phased plan.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172