Network Segmentation and Clinical Continuity in Hospital IT

Map clinical workflows before segmenting

The first step is not creating VLANs but understanding the hospital's systems and data flows. Segmentation done without knowing which services a device must reach, over which protocol and in which direction, can stop operations.

In imaging, for example, DICOM traffic between modalities and PACS, PACS integration with RIS or the HIS, physician workstations, reporting systems, archiving and vendor support must all be assessed together. For each system, record the business owner, technical owner, IP address, protocol, external connections, data classification and downtime tolerance.

Which zones should a hospital network be divided into?

There is no single standard VLAN list that fits every hospital. Segmentation should be based on device type, data sensitivity, function and access needs.

Define the permitted communication for every zone

For each security zone, write down which destinations it may reach, which side initiates the connection, which ports are used, whether internet access is needed and how management access works. Policies should be built from validated workflows, not from an "allow everything and close it if something breaks" approach.

NIST's PACS security guide notes that VLAN segmentation can reduce unwanted lateral movement but does not by itself stop movement within the same segment. Some critical devices and systems may need finer-grained filtering or microsegmentation. NIST SP 1800-24 PACS security guide

Apply 802.1X and NAC with care

802.1X and NAC help identify the users and devices connecting to the network. Corporate computers can be authenticated with certificates or user identity, and different network policies can be applied according to role.

Older medical devices may not support 802.1X. In such cases, device profiling, controlled MAC-based exceptions or designated switch ports can be considered. Every exception should have an owner, a clinical purpose, permitted destinations and a review date.

An outage of the NAC or RADIUS service that leaves the entire hospital unable to connect is a separate risk. High availability, a controlled fail mode and an alternative access method must be tested before going live.

Vendor and service connections should not stay open permanently

Medical device and clinical application vendors may request remote access for maintenance. Instead of shared accounts and always-on VPN connections, use individual identities for each technician, MFA, time-limited permissions and a controlled jump system.

1. The maintenance request and internal approval are recorded.
2. Access is opened only to the relevant devices and ports.
3. The session and the actions taken are logged.
4. Permissions are closed automatically when maintenance is complete.

Back up critical network services at the service level

An outage of DNS, DHCP, RADIUS, NAC, the firewall, the wireless controller or a core switch can affect many clinics at once. Redundancy is not just buying two devices; it means the service can continue within an accepted time when something fails.

• Is it known how existing and new clients behave if DNS or DHCP goes down?
• Is automatic failover in the firewall pair tested regularly?
• Has access point behavior been verified for loss of the wireless controller?
• Is clinical traffic prioritized over guest traffic on the backup internet line?
• Is there an alternative path and rollback plan for a core switch failure?

A downtime plan is not just an IT document

In some incidents, systems cannot be brought back immediately. Patient admission, laboratory and imaging orders, critical result reporting, medication processes and patient identification methods should be planned together with how they will run temporarily without technology.

Storage of paper forms, re-entry of data once systems are back, reconciliation of data generated during the outage and communication with clinical teams should be defined in advance. Information security policies of Turkish public hospitals likewise define information management as one of the fundamental requirements of patient safety and safe care. Example: a public hospital information security policy (Turkish)

A switch being up does not mean clinical services are working

The monitoring system should track not only device availability but service indicators such as HIS response time, PACS send queues, DICOM errors, laboratory integration delays, DHCP pool utilization, DNS response time and unknown devices.

The HHS healthcare sector cybersecurity goals treat asset inventory, network segmentation of critical systems, centralized logging and incident response readiness as complementary controls. HHS healthcare sector cybersecurity performance goals

Validate technical changes against clinical function

Changing the network policy of a medical device is not an ordinary switch change. The affected clinical services should be identified, and the biomedical team, the relevant clinical unit and the vendor should be involved. After testing or a controlled pilot, not only connectivity but the related clinical function must be verified.

Every change should have a rollback plan, success criteria and named owners. For detailed steps, see the enterprise IT change management guide.

Design security and clinical continuity together

Hospital network segmentation is not about increasing the number of VLANs. The goal is to protect clinical systems, medical devices and patient data while keeping patient care running. Accurate inventory, controlled data flows, identity-based access, managed vendor connections, high availability and clinical downtime procedures must be addressed together.