Walk into the network closet at many nursing homes and assisted living communities, and you will find one flat network. Clinical computers, the business office, guest Wi-Fi, smart TVs, security cameras and medical devices all share the same space. That is easy to set up and hard to defend. If one device is infected, it can reach almost everything else.
Network segmentation divides a network into zones, with rules controlling what can talk to what. Think of it as doors between rooms in a building, rather than one giant open room.
Containment. If a visitor's phone or an old device is compromised, it cannot reach resident records.
Protection for fragile devices. Many medical and building devices run old software that cannot be patched easily. Isolating them reduces exposure.
Performance. Streaming video on guest Wi-Fi should not compete with charting.
Easier monitoring. When each zone has a clear purpose, odd behavior stands out.
Support for compliance. The HIPAA Security Rule expects access controls and safeguards for electronic PHI. Segmentation is one way to restrict access to what is needed.
Workstations, laptops and tablets used for charting, billing and email. This zone needs the strongest controls.
Servers, backup devices and anything storing PHI locally. Restrict who can reach these and from where.
Connected monitors, pumps, scales and similar devices. Work with the manufacturer on supported configurations, and avoid exposing these to the internet.
Cameras, door access, thermostats, nurse call and smart TVs. These are often installed by outside contractors and rarely updated. Keep them off the clinical network.
Residents and visitors want internet access, not access to your files. This network should only reach the internet and should be isolated so guests cannot see each other's devices or yours.
Phones and VoIP often have their own zone for quality and security.
The technical tools are VLANs (virtual networks configured on managed switches and access points) and firewall rules that decide what traffic may pass between them. Your IT provider will usually build this with:
Managed switches that support VLANs
A firewall that routes between zones and enforces rules
Wireless access points that broadcast separate network names tied to separate zones
Unmanaged consumer-grade switches cannot do this, so check your equipment first.
Segmentation done carelessly can break systems that depend on each other. A phased approach works best.
Inventory devices. You cannot segment what you do not know about. List everything connected, including the odd ones.
Map dependencies. Identify which devices need to talk to which servers, such as a lab device sending results to a system.
Start with guests. Isolating guest and resident Wi-Fi is low risk and high value.
Move building systems next. Cameras and TVs are typically straightforward to relocate.
Then medical devices. Coordinate with vendors and clinical staff, and test carefully.
Tighten rules gradually. Begin by logging traffic, then restrict it once you know what is normal.
Document everything. Keep a current diagram and a list of rules and their reasons.
Creating zones but allowing everything between them, which gives no real protection
Forgetting printers, scanners and fax devices
Leaving default passwords on switches and access points
Failing to update the network diagram afterward
Making changes during a busy shift without a rollback plan
Which zones exist today and which devices are in each?
Can a guest device reach any internal system?
Are our cameras and building controllers separated from clinical computers?
Who approves a rule change between zones, and is it logged?
Segmentation touches many systems, and mistakes can interrupt care. UnityCare IT designs and implements network segmentation for healthcare facilities, scheduling changes around clinical workflows. If you are not sure what is plugged in to your network, an inventory is a good first step.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172