Network segmentation in a clinic: medical devices and Wi-Fi

Network segmentation in a clinic means dividing one network into several separated parts. Staff workstations, medical devices, Wi-Fi for patients and guests, and printers, cameras and other technical devices each get their own segment. A firewall between the segments lets through only the traffic needed for work. Medical devices that cannot be updated go into the narrowest possible segment, with access only to the systems they exchange data with.

As a result, a patient’s infected phone or an old scanner does not become a path to medical records. We design and configure segmentation as part of our network infrastructure services for hospitals and clinics, together with cabling, switches and staff Wi-Fi.

Why one shared network is a risk

In many clinics the network grew along with the clinic. New consulting rooms, printers, the CCTV recorder and a new ultrasound scanner were all added to one network. Staff and patients often even used the same Wi-Fi password.

A flat network like this works until something goes wrong. When malware reaches one computer, it can freely try to get into the server, the shared document folders and the backups. Segmentation contains the threat within one part of the network.

Which segments a clinic network needs

Segment	What it contains	What it can access
Staff workstations	computers at reception and in consulting rooms, laptops	the hospital information system (HIS), printers, the internet, selected services
Servers	the HIS server (if it runs locally), file server, backups	only the traffic the services need to run
Medical devices	diagnostic equipment, vendor workstations	only PACS (picture archiving and communication system), the HIS or other systems they exchange data with
Printers and technical devices	printers, CCTV recorder, IP phones, access control	only the services they require
Management	administrative interfaces of network devices	administrators only
Wi-Fi for patients and guests	guests’ phones and laptops	the internet only, with no access to the internal network

In a smaller clinic some segments can be combined. Three segments should always be kept apart, though: staff, medical devices and guests. Each segment is a separate virtual network (VLAN) on the switches and a separate zone on the firewall.

Which rules to set between segments

The starting point is to block all traffic between segments. Then we open only specific connections, each with a clear reason. An example set of rules for a clinic:

• staff workstations connect to the HIS, printers and the internet, but not to the interfaces of medical devices
• medical devices send scans to PACS and download the worklist (the list of scheduled patients) from the system, with no internet access
• printers and cameras accept connections only from the workstations and servers that use them
• administrative interfaces are available only from dedicated administrator accounts
• guest Wi-Fi has access to the internet only

The firewall logs blocked connection attempts. The logs show which device is trying to connect where it should not. We review the rules whenever a new device is added, so that over time they do not turn into a list of exceptions.

Traffic between segments is controlled by a next-generation firewall (NGFW), a device that recognises applications and blocks known attacks. We are an authorised Fortinet partner and deploy FortiGate firewalls, and our engineers hold Fortinet certifications. The details are on the cybersecurity page of Conetso Group, the business IT brand of the same company (CONETSO GROUP Sp. z o.o.). On the same firewall we configure a backup internet connection, which matters especially for a cloud-based system. We wrote about this in our article Optimed NXT: cloud or on-premises server.

Wi-Fi for patients and guests in a separate segment

Wi-Fi for patients is a convenience that must not become a back door into the clinic’s network. When we configure it, we follow a few rules:

• a separate network name (SSID) and a separate segment, with no route to the internal network
• device isolation, so that patients’ phones cannot see one another
• a bandwidth limit, so that guests do not slow down reception or data exchange with P1, Poland’s national e-health platform
• content filtering on the firewall
• a password changed regularly, or a simple welcome page with terms of use

Staff should not work on the guest network. Staff members’ personal phones and laptops also belong in the guest segment, not in the network with the HIS.

An example from our work: in one clinic, medical equipment was connected to the guest Wi-Fi, and the guest network had access to internal resources. Segmentation is exactly how we fix situations like this: the equipment gets its own segment, and the guest network goes out to the internet only.

Medical devices that cannot be updated

The software on diagnostic equipment is usually updated by the manufacturer or its service company, outside your IT team. That is why some devices run older system versions, and many cannot have antivirus software installed. You cannot secure such a device like an ordinary computer. You can, however, limit what it connects to on the network.

We start with a list of the medical devices in the clinic. For each one we record the system version, the service company and the systems it exchanges data with. From the vendors we collect the network requirements: addresses, ports and services. Without this list, segmentation usually ends with all traffic being opened, because otherwise the device stops working.

In practice, every device without updates goes into a separate segment, under these rules:

• a separate segment, and for the oldest equipment even a segment for a single device
• access only to PACS or the system the device downloads the worklist from
• no access to the internet or to staff workstations
• the manufacturer’s service team connects over a VPN only for the duration of the work, and the connection is logged
• any change to the device software is agreed with the manufacturer or the service company

When buying new equipment, ask the manufacturer how long it will provide security patches. The answer helps you plan when the device will move into a tightly closed segment.

Legal requirements

The law does not explicitly require network segmentation, but it does require security measures appropriate to the risks (legal status as of 8 November 2026). The Regulation of the Minister of Health of 6 April 2020 on the types, scope and templates of medical records and the manner of processing them (in Polish; consolidated text, Journal of Laws 2026, item 1391), § 1(4)–(5), requires, among other things, that medical records be available only to authorised persons. It also requires systematic risk assessment and security measures that take into account the state of the art. It also requires software to be kept up to date, safeguards to be monitored on an ongoing basis and their effectiveness to be assessed periodically.

A similar obligation for personal data follows from Art. 32 GDPR. Health data belongs to the special categories of personal data (Art. 9 GDPR), so the risk of a breach is assessed as higher.

The e-Health Centre (Centrum e-Zdrowia) has also published security recommendations for medical records in electronic form (in Polish).

Network segmentation is one of the simpler measures you can point to in your risk analysis. It clearly limits the impact of an incident, although on its own it does not guarantee security. You demonstrate compliance with the documentation of your risk analysis and of all the measures you have chosen (Art. 5(2) and Art. 24 GDPR).

When we bring order to a clinic’s network, we start with a list of devices and a review of the firewall rules. Get in touch if you want to sort out the segments in your clinic.