Healthcare Network Design: Safe Segmentation for Medical Devices

Securing the Hospital Network: Segmenting Medical Devices You Can't Patch

In a hospital, a network breach isn't a data problem. It's a patient-safety problem. 

The infusion pump on the ward runs software that can't be patched, won't accept a security agent, and often sits on the same flat network as the patient records and the nurse's workstation. Compromise one device, and on a flat network, an attacker can reach them all, which is exactly how ransomware has shut down hospitals and put lives at risk. 

Healthcare network design exists to prevent that. And because you can't secure the medical devices themselves, the job falls to the network. Here's how to design one that protects devices it can't patch, without disrupting the clinical work that depends on them. 

Why Are Medical Devices So Hard to Secure? 

Because they were never built to be secured the way IT is. Medical devices, the Internet of Medical Things, run legacy operating systems that can't be patched, can't accept security agents, and have long clinical lifecycles measured in a decade or more. Traditional endpoint security has nothing to install on them. 

The scale of the exposure is sobering. Recent data found medical devices averaging over six vulnerabilities each, around 60 per cent running end-of-life systems, and 99 per cent of hospitals exposed (IoMT vulnerability statistics). And most hospitals can't even see all their devices, poor inventory visibility is one of the most-cited gaps. 

So the medical device is a paradox: critical to patient care, connected to the network, and impossible to harden. It can't defend itself, and you can't make it. 

Why Is a Flat Hospital Network Dangerous? 

Because it turns one compromise into a catastrophe. On a flat network, every device can reach every other, so an attacker who lands on a single vulnerable endpoint, a workstation, an unpatched device, can move laterally to the clinical systems and encrypt them. Lateral movement drives the majority of successful healthcare attacks, and ransomware operators exploit exactly these flat-network gaps. 

The consequence in healthcare is not just downtime and a data breach notice. It's a hospital that can't access records, imaging or connected devices mid-treatment. Patient safety is directly on the line, which is what makes a flat hospital network not merely a security weakness but a clinical risk. 

That's the case for segmentation, and it's why it's moving from best practice to requirement. 

How Do You Secure Devices You Can't Patch? 

You move the protection to the network. If you can't harden the medical device, you surround it, making the network responsible for what the device can and cannot reach. This rests on two pillars: seeing every device, and confining each one. 

Visibility comes first, because you can't protect what you can't see, and most hospitals don't have a complete medical-device inventory. You discover and profile every connected device, what it is, what it should talk to, so you know the estate before you try to secure it. 

Confinement follows: segmentation that limits each device to only the communication its clinical role requires. Do both, and an unpatchable device becomes far less dangerous, not because it's secure, but because a compromise of it can't go anywhere. 

How Does Segmentation Protect Medical Devices? 

By shrinking the blast radius to almost nothing. Instead of one flat network, you divide it into zones and allow only the traffic that clinical function needs. Infusion pumps don't need to reach the nurse-station network; imaging systems don't need open access to the electronic health record. Segmentation enforces exactly that: 

With least-privilege segmentation, ransomware that lands on one device can reach only what that device's role permits, so it cannot spread across the clinical estate. The infection is contained to a room, not the hospital. 

How Do Cisco ISE and Cyber Vision Do This? 

By profiling the devices and letting the network enforce the zones, without touching the devices themselves. Cisco Cyber Vision discovers and profiles the connected devices, including medical and IoT equipment, and groups them into zones of trust based on what they are and how they behave. Cisco ISE, the Identity Services Engine, then enforces access policy across the network, denying communication by default and permitting only what's explicitly allowed (Cisco ISE and Cyber Vision). 

The two work together: Cyber Vision's device profiles feed ISE, and any change is pushed through automatically, so the segmentation adapts as the device estate changes. The Catalyst switches enforce the policy in the network itself, which means you segment the medical devices without reconfiguring or risking them, crucial when the device is a patient monitor you can't afford to disturb. 

This is the key point for a healthcare CISO: identity-based micro-segmentation lets you protect unpatchable devices through the network they're plugged into, rather than through agents they can't run. 

How Do You Segment Without Disrupting Clinical Workflows? 

Carefully, and this is the barrier that stops many hospitals. The single biggest reason healthcare organisations hesitate on segmentation is fear of breaking clinical workflows, and that fear is legitimate: a segmentation rule that blocks a legitimate device-to-system communication could interfere with patient care. 

The answer is visibility-first and phased. You profile the devices and learn their real communication patterns before writing a single blocking policy, so the zones you create allow every clinically necessary path. Then you roll segmentation out in stages, starting with the clearest wins, guest and IoT isolation, then the highest-risk device groups, validating that clinical workflows are unaffected at each step. Done this way, segmentation tightens security without a clinician ever noticing. Done recklessly, it's the outage everyone feared. The method matters as much as the tools. 

Availability and Compliance 

Two more demands shape a healthcare network. It must be highly available, because clinical systems are life-critical and an outage in an ICU or theatre is dangerous, so redundancy and resilient design are not optional. And it must meet data-protection obligations: patient health data is among the most sensitive personal data there is, falling squarely under India's DPDP rules and their requirement for reasonable security safeguards, of which segmentation and access control are central. Globally, healthcare regulation is moving the same way, with segmentation shifting from recommended to required. 

So the segmentation that protects patient safety also satisfies the regulator, and the resilient design that keeps the network up is itself a safety measure. The clinical, the security and the compliance cases all point to the same architecture. 

The Approach: See, Zone, Enforce, Monitor 

Pulled together, healthcare network security follows a clear sequence. See every device through discovery and profiling. Zone them into groups by type and risk. Enforce least-privilege policy so each device reaches only what it must. And monitor continuously, because the device estate and the threats both change. Each step depends on the one before, and none of it should disrupt the ward. 

Designing the Hospital Network Safely 

Segmenting a live hospital network, unpatchable devices, life-critical uptime, clinical workflows that can't break, is precisely the work that needs networking and security expertise in one team, and a method that protects patients rather than endangering them. Proactive Data Systems, a Cisco Preferred Partner with 35 years of experience and more than 1,500 customers, designs healthcare networks with medical-device visibility through Cyber Vision, identity-based segmentation through ISE and Catalyst, and the resilience clinical systems demand, phased so clinical workflows are never disrupted. If you're securing a hospital network and its medical devices, ask us to design the segmentation safely.