Healthcare needs internal segmentation because hospitals run many devices that cannot be patched quickly, and a flat network lets one compromised device reach patient data and clinical systems. Dividing the network into zones, with controlled paths between them, limits how far an intruder can move. It supports risk management but is not a complete defense.
What problem does segmentation solve?
Most networks were built with a hard edge and a soft inside. Once something is in, it can talk to almost everything. NIST's zero trust architecture document states the response: zero trust "assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location". Location inside the network earns nothing.
Healthcare makes this acute. Imaging systems, infusion pumps and legacy clinical workstations often run old software for long periods because replacing or updating them involves clinical validation. A device you cannot patch is a device you must isolate.
What does the HIPAA Security Rule say about it?
We could not fetch the rule's text directly for this article, so we rely on NIST's guide. NIST SP 800-66 Rev. 2 explains that the HIPAA Security Rule focuses on safeguarding electronic protected health information, which must be protected "against reasonably anticipated threats, hazards, and impermissible uses and/or disclosures". The guide covers risk assessment and risk management, and technical safeguards. The framing is risk based: you assess reasonably anticipated threats and choose protections. Segmentation is one widely used way to answer a lateral movement threat. Check with your compliance counsel before describing it as a requirement.
HHS runs a program called 405(d) that publishes Health Industry Cybersecurity Practices, aligning healthcare security approaches with the Health Sector Coordinating Council. Its materials are a good place to look for sector specific practices.
What does a segmented hospital network look like?
Think zones, not walls. Typical zones:
- clinical devices, grouped by function
- clinical workstations and electronic records applications
- administrative and business systems
- guest and staff personal device networks
- building systems and security cameras
- management interfaces, reachable only from a small set of admin hosts
Controls between zones allow only the flows that are needed, for example the records application reaching its database. Everything else is denied by default and logged.
Why internal firewalls, not only an edge firewall?
An edge firewall sees traffic crossing the boundary. It sees nothing between two devices on the same switch. Internal enforcement, whether a firewall between zones or policy at the switch or host level, sees movement inside. That is where ransomware spreads.
What goes wrong?
Segmentation projects fail when they begin with a diagram and not with traffic. If you block flows you do not understand, clinical systems break and the project is cancelled. Observe first, then write rules, then enforce in stages, starting with the most sensitive zone.
A constructed example
A clinic maps traffic for a month and finds its imaging workstations talk to a file server, an archive, and, unexpectedly, the front desk network. The last one is a leftover shared printer setting. The team removes it, builds a zone for imaging with three allowed flows, and tests with the clinical lead present. A later malware infection on a front desk PC cannot reach imaging.
How to check or apply this
- Inventory devices, including medical ones, with their operating system and patch status.
- Capture real traffic flows for a few weeks before designing zones.
- Define zones by function and risk, with default deny between them.
- Enforce first around the systems holding patient records, then widen.
- Restrict management interfaces to a short list of admin hosts.
- Document the design as part of your risk analysis, and test it with a tabletop exercise.
Safeguard works at the software layer (dependency and code scanning, compliance automation) and does not provide network security products.
Quick check
Is segmentation required by HIPAA?
The Security Rule is risk based and does not name a specific technology in the guidance we fetched. Segmentation is a common way to address lateral movement risk.
Where should a hospital start?
Inventory devices and observe traffic. Then isolate the most sensitive zone, such as the patient records systems.
Sources
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 800-66 Rev. 2, HIPAA Security Rule resource guide
- HHS 405(d) program
Last reviewed: 18 October 2026.
