A hospital network that keeps clinical systems, medical devices and guests apart, and logs everything
A regional hospital group in the southeastern United States, a leader in its segment.
- Scale
- 6 campuses, 40 outpatient clinics, 12,000+ connected devices, 20+ segments
- Engagement
- Assessment, redesign and phased rollout over 9 months
The challenge
Infusion pumps, imaging systems, badge readers, building controls and guest Wi-Fi were all on networks that could reach the electronic health record. Many medical devices cannot run security software or be patched on demand, so the network itself had to contain them.
Hospitals are unusual networks: life-critical devices, decades-old equipment and some of the most sensitive data there is, all sharing cabling. The group's networks had grown campus by campus, and a flat design meant an infusion pump and a records server could, with the right mistake, reach each other. Many devices cannot run security software or be patched on demand, and replacing them was not an option, so the design had to put the control in the network.
Each class of device now has a home. Clinical workstations, medical equipment, building systems, administration, guests and card payments each live in a separate VLAN and routing domain, and traffic between them passes through a firewall that permits only named flows: imaging to the archive over DICOM, interfaces to the records system over HL7, nothing else. Access switches authenticate with IEEE 802.1X where a device supports it. For the many that do not, device profiling and MAC authentication bypass place them in a restricted segment, and an alert fires if a pump shows up on a workstation port. RADIUS change-of-authorization (RFC 5176) moves a device to a quarantine VLAN the moment its profile changes.
Cutover happened ward by ward in agreed windows, with clinical engineering present. Each ward was first mirrored: the new segments were built beside the old network, devices were profiled in monitor-only mode for two weeks, and the allow-lists were tuned against real traffic before anything was enforced. On the night, ports were moved in groups, a clinical engineer confirmed each device class still reported to its server, and the old flat network was retired segment by segment. Devices that failed profiling stayed on a legacy VLAN with tight firewall rules until their owners could be reached.
Testing was part of the design, not an afterthought. Before each wave we ran flows that must work (DICOM, HL7, badge and nurse-call traffic) and flows that must fail (a guest laptop reaching a records server, a pump reaching the internet). Core and distribution switches were failed by pulling power and links at the busiest hour of a test day, and traffic converged in well under a second with no dropped sessions on monitored devices. Logging was tested the same way: an investigator was asked to trace a planted test device from the moment it joined the network to the last packet it sent.
Logging was designed alongside segmentation rather than after it. Switch, firewall, wireless and authentication events flow to a central collector with synchronized time, so a team can follow a device from first connection onward. This supports the audit-controls requirement of the HIPAA Security Rule, 45 CFR 164.312(b); compliance itself is a program for the organization to run, not something a network can promise. The result is medical devices contained in their own segments, a network that identifies what is plugged in before it grants access, and one searchable audit trail that answers who and what touched which system, and when.
What our team delivered
- Clinical, medical-device (IoT), building-systems, administrative, guest and payment VLANs, each in its own routing domain behind firewall policy
- IEEE 802.1X authentication for staff devices and MAC-authentication bypass with device profiling for equipment that cannot authenticate
- Dynamic VLAN assignment so a device lands in the right segment wherever it is plugged in
- Allow-lists between segments for the protocols actually needed, such as DICOM and HL7 to named servers only
- Central, tamper-evident log collection of network, authentication and access events with defined retention, supporting the HIPAA Security Rule audit-controls requirement (45 CFR 164.312(b))
- Redundant core and distribution switching with tested failover
Result
Medical devices contained in their own segments, a network that identifies what is plugged in before it grants access, and one searchable audit trail that answers who and what touched which system and when. In the modeled engagement, the 12,000+ devices were profiled and placed into segments over nine months, clinic-by-clinic cutovers ran in overnight windows with a rollback plan, and unmanaged devices that could not authenticate were contained in restricted segments with a written exception and an owner. Failover of the redundant core was tested during rollout, and the audit trail retained events long enough to answer an investigation after the fact.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Roaming without dropping the call
Time from leaving one access point to the first data frame on the next, split by phase. A full WPA2/WPA3‑Enterprise re-authentication repeats the 802.1X exchange; 802.11r (Fast BSS Transition) reuses cached keys, 802.11k (neighbour reports) removes the blind scan, and 802.11v (BSS transition management) lets the network steer the client. Illustrative figures.
Twelve months of availability
Measured availability per site over twelve months against a 99.99% target, which allows 52.6 minutes of downtime a year. Six of seven sites meet it; Singapore misses and is shown in red. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.