← Back to all articles

When a health system detects an attacker on its network, leaders face a hard decision within minutes: how much do we shut off?

In many hospitals, the honest answer is "everything." The network was never built to be divided. Clinical applications, imaging, connected medical devices, guest Wi-Fi, vendor connections and back-office systems can all reach each other. When there's no smaller boundary to close, containment means taking down the patient portal, the EHR interfaces and the phones along with the problem.

This article covers why that happens, what current federal guidance says, and seven practical steps that let a healthcare organization contain an incident to one area instead of the whole enterprise.

The Problem: A Security Incident Is Now a Care-Continuity Incident

The pressure on healthcare networks hasn't eased this year.

  • Comparitech counted 185 ransomware attacks and unverified claims against U.S. healthcare organizations in Q3 2026, up 64% from Q2. Only 26 of those were confirmed, so the trend matters more than the exact count (Becker's Hospital Review, Oct 16, 2026).
  • In the 2026 Cyber Insecurity in Healthcare survey by Proofpoint and the Ponemon Institute, 97% of 705 U.S. healthcare organizations reported at least one cyberattack in the past 12 months. Of those attacked, 74% said patient care was disrupted. Operational disruption was the largest cost in the costliest attack, averaging $1.39 million (Proofpoint, Oct 2026).
  • IBM's 2026 Cost of a Data Breach report ranked healthcare the costliest industry for the 13th consecutive year, at an average of $6.64 million per breach (HIPAA Journal, Jul 29, 2026).

The operational pattern is consistent. In January 2026, AZ Monica hospital in Antwerp shut down servers at two campuses after a cyberattack. About 70 scheduled surgeries were cancelled and seven patients were transferred to other hospitals. This week, an Indiana health system disabled its network after detecting suspicious activity, which took its patient portal offline. That cause had not been confirmed at the time of writing (DysruptionHub, Oct 19, 2026).

Our analysis: taking systems offline fast is often the right call. The real issue is how many options a team has when it makes that call. A network that can be isolated in sections gives responders a choice between "shut down billing" and "shut down the hospital."

Why So Many Healthcare Networks Are Still Flat

Few organizations set out to build a flat network. It usually happens gradually.

  • Growth by acquisition. Practices, clinics and imaging centers get connected to the core network quickly, and the clean-up never gets scheduled.
  • Medical devices with long lifecycles. Many devices are vendor-managed, can't run security agents, and may never receive a patch. In January 2025, CISA and the FDA warned that a widely used patient monitor contained a backdoor and that no patch was available. The FDA's advice was to unplug the Ethernet cable and disable wireless where remote monitoring wasn't needed (SecurityWeek, Jan 31, 2025). Sometimes the network around a device is the only control you have.
  • Vendor remote access. Dozens of vendors may have persistent connections into clinical systems, often with broader reach than they need.
  • Fear of breaking clinical workflows. Segmentation projects stall because nobody wants to block a connection that a lab analyzer or infusion system quietly depends on.

Our analysis: the barrier is rarely technology. It's not knowing what talks to what.

What Current Guidance Says

HHS Healthcare and Public Health Cybersecurity Performance Goals (CPGs)

Published in January 2024, these voluntary goals list network segmentation as one of ten "enhanced" goals, alongside asset inventory, centralized log collection and configuration management. The "essential" goals include multifactor authentication, separating user and privileged accounts, and setting cybersecurity requirements for vendors.

The proposed HIPAA Security Rule update

Published in the Federal Register on January 6, 2025, the proposal would require covered entities and business associates to:

  • maintain a technology asset inventory and a network map showing how ePHI moves
  • segment their networks
  • use multifactor authentication
  • scan for vulnerabilities every six months and run penetration tests every year
  • be able to restore critical systems and data within 72 hours

The rule is still a proposal. HHS's regulatory agenda now targets finalization around July 2027, and more than 100 hospital and provider groups have asked HHS to withdraw it (Pact-One, Sep 4, 2026). Under the proposed timeline, organizations would have about 240 days after publication to comply.

CISA's zero trust microsegmentation guidance

CISA's July 2025 guidance describes microsegmentation as a way to reduce the attack surface, limit an attacker's lateral movement and improve visibility. It was written for federal agencies, but CISA states that its principles apply to any organization.

Our view: plan around the next incident, not the rule's publication date. Every step below is useful whether the final rule arrives in 2027, changes or never arrives.

Seven Healthcare Network Security Best Practices

  1. Build the map before you build the walls. Start with a technology asset inventory and a data-flow map: which systems store or process ePHI, and what each one needs to communicate with. On clinical networks, use passive discovery so you don't disrupt devices. Validate what you find with clinical engineering and biomedical teams, because they know which devices are actually in use.
  2. Define isolation zones by care impact, not by org chart. A practical starting set of zones is: internet-facing and guest; corporate and back office; EHR and clinical applications; medical devices, grouped by type and criticality; imaging; vendor access; and the management network. For each zone, answer three questions. Can it be cut off on its own? What stops working when it is? Who has authority to do it at 2 a.m.?
  3. Put medical devices in their own segments with allow-listed traffic. Devices should talk only to the servers they need. Block internet access unless the vendor documents a requirement for it. Ask manufacturers for their Manufacturer Disclosure Statement for Medical Device Security (MDS2) form, which describes a device's security capabilities and network needs.
  4. Narrow vendor access. Inventory every remote connection. Replace always-on VPN tunnels with brokered access that requires MFA, is time-limited and is logged, and limit each vendor to the segment it supports. A vendor's SOC 2 report helps you judge its controls. It doesn't replace limiting what the vendor can reach (see SOC 2 vs HIPAA Compliance).
  5. Protect the management plane. Network devices, directory services, virtualization platforms and backup consoles can affect everything at once, so they belong on a separate administrative network. Use separate privileged accounts and MFA for that network. As we noted in our manufacturing downtime article, an attacker with admin rights can use legitimate tools to cause widespread damage.
  6. Monitor the traffic between zones. Segmentation without monitoring is a wall without a guard. Collect logs centrally, record traffic that crosses zone boundaries, and alert on new or unexpected connections, especially from device and vendor segments.
  7. Rehearse the isolation. Run a tabletop exercise with clinical and operations leaders, not just IT. Use a scenario like "a billing workstation is compromised overnight." Confirm who decides, which isolation rules are applied, and how long each department can work on downtime procedures. Then test restoring a segment. The proposed 72-hour restoration standard is a useful benchmark even before it becomes a requirement.
Phase the work. Start with the highest-risk boundaries, which are usually guest and internet, vendor access, and medical devices. Run new rules in monitor-only mode before enforcing them, and schedule changes in clinically approved maintenance windows.

The IT Leadership Perspective

Our view: segmentation is a care-continuity investment, not a firewall project. That means its progress should be reported in terms executives and clinical leaders recognize:

  • How many zones can we isolate independently today?
  • How long does it take to isolate one?
  • What percentage of connected medical devices are inventoried and assigned to a segment?
  • How many vendor connections still have persistent, unrestricted access?

These measures turn "are we secure?", which nobody can answer honestly, into questions with real answers. They also give COOs and CMIOs a reason to stay involved, because they will own the downtime decisions when an incident happens.

Where ITSN Fits

ITSN works with healthcare and health-tech organizations as a vendor-neutral partner. Our security practice covers security assessments and gap analysis, zero-trust and network security, identity and access management, continuous monitoring and threat detection, and incident response planning. Our Voice & Data practice designs and optimizes the networks those controls run on. When internal teams need more capacity, our staff augmentation team provides network and security specialists who work inside your processes.

A practical first step is a network security assessment. It maps how ePHI moves through your network, identifies flat areas and unmanaged devices, and delivers a phased segmentation plan ranked by care impact. For the wider picture, see our guide to cybersecurity services for healthcare.

Conclusion

No organization can promise that an attacker will never get in. What you can decide in advance is how far an attacker can move once inside, and how much of the hospital you would need to shut off to stop them.

A network built in sections gives your team options during an incident. A flat network leaves them one option: shut everything down.

Frequently Asked Questions

What is healthcare network security?

It's the set of controls that protect a healthcare organization's network and everything connected to it, including EHR systems, medical devices, imaging, vendor connections and guest access. The goal is to prevent unauthorized access and to contain incidents when they happen.

Does HIPAA require network segmentation?

The current Security Rule doesn't name segmentation explicitly. It requires a risk analysis and appropriate safeguards, and segmentation is a common way to meet those requirements. HHS's proposed update, published in January 2025, would make segmentation an explicit requirement. It has not been finalized.

How do you secure medical devices that can't be patched?

Put them in a dedicated segment, allow only the connections they need, block internet access unless it's required, and monitor their traffic. Work with the manufacturer, using the MDS2 form, to understand each device's network needs.

What's the difference between segmentation and microsegmentation?

Segmentation divides a network into zones, such as clinical, guest and devices. Microsegmentation applies narrower rules to individual workloads or device groups, which further limits how far an attacker can move.

How often should healthcare network security be tested?

The proposed HIPAA update would require vulnerability scanning every six months and penetration testing every year. Many organizations already use that schedule as a baseline.