Why Do You Need Network Segmentation in Healthcare?

Network segmentation in healthcare is necessary to prevent a cyberattack or data breach from spreading to other systems within the same network. By splitting the network into isolated zones, you limit the damage an attacker can cause and protect sensitive patient data. In the articles below, you can read about the risks, how segmentation works, and how to get started.

What risks arise without network segmentation in healthcare?

Without network segmentation in healthcare, everything resides on the same network: patient records, medical equipment, office computers, and visitor Wi-Fi. If one device is compromised, an attacker can move freely throughout the entire network. This significantly increases the risk of a large-scale data breach or disruption of critical care processes.

Healthcare is an attractive target for cybercriminals because medical data is particularly valuable. An unsegmented healthcare network carries a number of concrete risks:

• Lateral movement: an attacker who gains access through a vulnerable IoT device, such as an infusion pump or security camera, can push through to systems containing patient records.
• Ransomware outbreak: ransomware spreads rapidly across a flat network and can take down all systems within a short time, including operating rooms and intensive care units.
• Data breaches: sensitive medical information accessible via an unsecured printer or guest network constitutes a direct violation of privacy legislation.
• Unauthorized access: without segmentation, employees, vendors, or visitors may inadvertently gain access to systems for which they have no authorization.

The consequences are not only technical. A disruption to the healthcare network can have a direct impact on patient safety. Think of the unavailability of medication systems, imaging equipment, or communication platforms for healthcare professionals. Network segmentation limits that impact by containing damage to a single zone.

How does network segmentation work in a healthcare environment?

Network segmentation in a healthcare environment works by splitting the network into logical zones, also known as segments or VLANs (Virtual Local Area Networks). Each segment has its own access rules and communication policies. Traffic between segments is monitored and filtered so that only authorized communication is allowed through.

In practice, this means that a hospital or healthcare institution sets up multiple separate network segments, each for a specific purpose. Traffic between those segments passes through a firewall or a layered network architecture that determines which systems may communicate with each other and under what conditions.

VLANs as the technical foundation

VLANs are the most widely used technique for network segmentation in healthcare. They make it possible to create separate networks at the software level, without requiring separate physical cabling. A VLAN for medical equipment is completely isolated from the VLAN for office automation or the guest network. Communication between VLANs is only possible if a firewall explicitly permits that connection.

Microsegmentation for additional granularity

In addition to traditional VLAN segmentation, microsegmentation is increasingly being applied in more complex healthcare environments. This approach not only shields network segments but also isolates individual workloads, applications, or devices from one another. This provides a more fine-grained security layer, particularly relevant for data centers and cloud connections within healthcare organizations. Our security solutions are specifically designed for this purpose.

Which systems and devices need to be segmented?

In a healthcare environment, at a minimum, medical equipment, patient data systems, office automation, management networks, and guest networks must be placed in separate segments. Each of these categories has a different risk profile and different communication requirements, which demands a tailored approach when setting up the segmentation.

A practical breakdown for network segmentation in a hospital or other healthcare institution typically looks as follows:

• Medical equipment (biomedical network): infusion pumps, monitoring equipment, ventilators, and other clinical systems. These devices often run on outdated software and are therefore vulnerable. Isolation is essential.
• Clinical information systems: EHR (electronic health record), PACS (image storage), laboratory systems, and pharmacy systems. High availability and strict access control are required here.
• Office automation: workstations, email, and intranet for administrative staff. This segment has different requirements than clinical systems and must never communicate directly with medical equipment.
• Management network (out-of-band management): a separate segment for network management, so that administrators always have access to infrastructure components, even if the production network is disrupted. See our out-of-band management solutions for this purpose.
• Guest network: Wi-Fi for patients, visitors, and vendors. This segment has no access to internal systems and is completely isolated from the rest of the infrastructure.
• IoT and building management systems: access control, cameras, climate control, and smart lighting systems. These devices are often poorly secured and represent an attractive attack vector.

The exact breakdown depends on the size and type of healthcare organization. A general practice has different needs than an academic hospital, but the principle is the same: systems with different risk profiles belong in separate zones.

What are the requirements under NEN 7510 and other healthcare regulations?

NEN 7510 is the Dutch standard for information security in healthcare. The standard requires healthcare organizations to implement appropriate measures to ensure the confidentiality, integrity, and availability of patient data. Network segmentation is not an explicit obligation, but is considered a necessary measure to comply with the standard.

NEN 7510 is based on the international ISO 27001 standard and contains specific requirements for the healthcare sector. Relevant requirements that directly relate to network segmentation include:

• Access security: only authorized users and systems may have access to patient data. Segmentation is a technical measure that enforces this.
• Network segregation: the standard explicitly prescribes that networks must be divided based on trust levels and risk groups.
• Continuity of care: measures must prevent an incident from affecting the availability of critical systems. Segmentation limits the spread of incidents.

In addition to NEN 7510, there are other relevant frameworks. The GDPR (General Data Protection Regulation) sets requirements for the protection of special categories of personal data, including medical information. The NIS2 directive, which is gaining increasing force in 2026, applies to healthcare organizations classified as essential entities. Network segmentation is a concrete technical measure that contributes to compliance with all of these frameworks. Protecting sensitive data starts with a well-configured network.

When is network segmentation difficult to implement in healthcare?

Network segmentation in healthcare is most difficult to implement when the existing infrastructure is outdated, medical equipment does not support modern network configurations, or when the dependencies between systems have not been sufficiently mapped. In those situations, segmentation requires careful preparation to avoid jeopardizing continuity of care.

Common challenges include:

• Legacy medical equipment: many medical devices run on outdated operating systems that do not support modern security protocols. They sometimes communicate via fixed IP addresses or legacy protocols that are difficult to segment without disrupting their operation.
• Undocumented network dependencies: in healthcare organizations that have grown over the years, systems are sometimes interconnected in unexpected ways. Breaking those connections without full visibility can lead to disruptions in critical processes.
• Limited IT capacity: healthcare organizations often have relatively small IT teams that must handle all other management tasks in addition to segmentation. A phased approach is therefore more realistic than a complete overhaul all at once.
• Vendor dependency: some medical systems are managed by external vendors who impose specific network requirements. Coordination with those vendors is necessary before segmentation can be implemented.
• Availability requirements: critical healthcare systems cannot go offline for maintenance. Segmentation must be implemented without interrupting patient care, which requires precise planning and testing procedures.

These challenges are real, but surmountable. A thorough inventory of systems, traffic flows, and dependencies is the foundation for a successful implementation.

How do you get started with network segmentation in a healthcare organization?

Start network segmentation in a healthcare organization by first creating a complete overview of all systems, devices, and traffic flows on the network. Without that insight, it is impossible to define meaningful segments. Next, set priorities based on risk and proceed in a phased manner.

A practical step-by-step approach:

1. Inventory the network: map all connected devices and systems, including medical equipment, workstations, servers, and IoT devices. Use monitoring and network management tools that also detect unknown devices.
2. Analyze traffic flows: understand which systems communicate with each other and why. This forms the basis for determining segment boundaries and the access rules between them.
3. Define segments based on risk: group systems with similar risk levels and communication requirements. Medical equipment, clinical information systems, and office automation belong in separate zones.
4. Draw up a phased implementation plan: start with the highest-risk areas, such as isolating medical equipment and separating the guest network. Then roll out the segmentation step by step.
5. Test before you implement: validate in a test environment that the segmentation works as intended and that critical communication is not unintentionally blocked.
6. Monitor and maintain: network segmentation is not a one-time intervention. New devices, systems, and vendors require ongoing attention. Establish processes for managing the segmentation over time.

You do not have to do this alone. We help healthcare organizations at every step of this process, from the initial inventory to the design and implementation of future-proof network segmentation. With more than 20 years of experience in complex network infrastructures and a vendor-independent approach, we deliver a solution tailored to your specific situation. Explore our networking solutions or contact our experts to discuss the best approach for your healthcare organization.