Why Clinical Networks Are Different
Most SMB network designs follow a simple model: staff devices, a few servers, guest Wi-Fi. Medical and allied health clinics need more nuance because the stakes of getting it wrong are higher:
- Patient data sensitivity: Health information is among the most sensitive personal data a business can hold. The Privacy Act 1988 and the Australian Privacy Principles impose specific obligations on healthcare providers — and a breach involving patient records carries significant financial and reputational consequences.
- Clinical device reliability: A clinical device that loses network connectivity mid-consultation is a patient safety issue, not just an IT inconvenience. Imaging equipment, electronic health record systems, and pathology interfaces need prioritised, reliable connectivity.
- Mixed device risk profiles: A clinic network typically includes high-trust clinical workstations, medium-trust admin devices, and low-trust patient-facing Wi-Fi — all of which need to coexist on the same physical infrastructure without being able to compromise each other.
- Vendor-specific requirements: Clinical software vendors (Best Practice, Medical Director, Genie, Cliniko) often have specific network requirements for their practice management and clinical data systems that need to be accommodated in the network design.
The Recommended VLAN Structure for a Medical Clinic
VLAN by VLAN: What Goes Where and Why
Dedicated workstations used for clinical purposes: EHR access (Best Practice, Medical Director, Genie), prescribing, pathology viewing, referral letters. These are the highest-trust devices on the network. They need reliable access to VLAN 30 (clinical servers) and internet access for cloud-hosted clinical tools, but should not have access to patient Wi-Fi devices or admin VLAN beyond what's necessary.
Reception and administrative staff devices. These need access to the practice management system for bookings, billing and patient registration — but do not typically need access to clinical server data directly. Separating admin from clinical workstations limits the impact of an admin device compromise on clinical workflows and data.
On-premises clinical servers, practice management databases, and backup systems. This is the most sensitive VLAN — it holds patient records. Access is restricted to clinical workstations (VLAN 10) by explicit firewall rule. No internet access except for software update servers. No access from admin, patient Wi-Fi, or medical devices.
Clinical equipment with network connectivity: ECG machines, spirometers, retinal cameras, pathology analysers, access control panels, and environmental monitoring. These devices often run older embedded firmware and are poor candidates for patching — isolating them limits the risk if they're compromised. Outbound internet is blocked except for specific vendor update services. They communicate with clinical systems via explicit, narrow firewall rules only.
Wireless access for staff clinical devices: laptops used in consultation rooms, tablets on ward rounds, mobile dictation devices. Separate from the patient Wi-Fi SSID on the same physical access point. Maps to VLAN 10 permissions — access to clinical servers, EHR systems, and internet.
Waiting room Wi-Fi for patients. Internet access only — completely isolated from all internal VLANs. Rate limited (typically 10–20Mbps per device, session time limit) to prevent one patient from consuming all available bandwidth. Ideally captive portal with usage terms acceptance. Under no circumstances should this VLAN have any path to clinical data.
Firewall Rules: What's Allowed, What's Not
| Source VLAN | Destination | Policy | Notes |
|---|---|---|---|
| VLAN 10 (Clinical WS) | VLAN 30 (Servers) | ✓ Permit | Core clinical workflow — EHR access |
| VLAN 10 (Clinical WS) | Internet | ✓ Permit | Cloud clinical tools, pathology portals |
| VLAN 20 (Admin) | VLAN 30 (Servers) | ~ Conditional | Only specific ports (booking system, billing) — not full access |
| VLAN 40 (Medical Devices) | VLAN 30 (Servers) | ~ Conditional | Only specific device ↔ system pairs (e.g., ECG machine → results server) |
| VLAN 40 (Medical Devices) | Internet | ✗ Block | Except specific vendor update URLs (allowlist) |
| VLAN 50 (Clinical Wi-Fi) | VLAN 30 (Servers) | ✓ Permit | Same as VLAN 10 clinical workstations |
| VLAN 60 (Patient Wi-Fi) | Any internal VLAN | ✗ Block | Internet only — absolute isolation from all internal resources |
| Any VLAN | Any internal VLAN (not listed above) | ✗ Block | Default deny — all inter-VLAN traffic denied unless explicitly permitted |
Wi-Fi Design for Clinical Environments
Clinical Wi-Fi has specific requirements that standard office Wi-Fi design doesn't account for:
- Seamless roaming between consultation rooms: A staff member carrying a tablet between rooms shouldn't experience network disruption mid-conversation with a patient. 802.11r (fast BSS transition) and 802.11k/v (neighbour reports and BSS transition management) must be enabled. Aruba's implementation of these standards is more reliable than Ubiquiti's in our experience — which is why we typically recommend Aruba for clinical Wi-Fi.
- Signal consistency, not maximum range: Clinical Wi-Fi APs should be placed for consistent -65 to -70dBm coverage everywhere staff might use devices, with no dead zones in consultation rooms, treatment areas, or corridors between them.
- Separate SSIDs, same physical infrastructure: "ClinicStaff" (VLAN 50) and "PatientWiFi" (VLAN 60) broadcast from the same access points — but are logically completely separate. No bridging between them. No inter-SSID traffic allowed.
- Security for clinical SSID: WPA3-Enterprise or WPA2-Enterprise with certificate-based authentication for the clinical SSID. This ensures only known, approved devices can connect to the clinical network — a personal phone cannot join the clinical SSID even if the user knows the password, because certificate authentication is required.
We deployed this architecture across a 4-site Melbourne medical centre group. Each site runs a FortiGate firewall with site-to-site VPN for multi-site connectivity, Aruba access points for clinical and patient Wi-Fi, and a managed switch for VLAN segmentation. The result: clinical devices roam seamlessly between rooms, patient Wi-Fi is completely isolated, and all sites share centralised practice management over an encrypted VPN link.
Multi-Site Clinics: Additional Considerations
For clinics with multiple sites sharing a practice management system, the network design needs to extend across sites:
- Site-to-site VPN: FortiGate at each site establishes an encrypted IPsec tunnel to the head-office site where the clinical server is hosted. All clinical data between sites traverses this encrypted tunnel — never over the public internet without encryption.
- Consistent VLAN numbering: Using the same VLAN IDs at every site simplifies policy management and reduces configuration errors. VLAN 10 is always clinical workstations, regardless of which site.
- Centralised firewall management: For 3+ sites, FortiManager provides a single management console to push consistent policy updates across all sites simultaneously.
Compliance Considerations
While Australia doesn't have a direct equivalent to HIPAA, healthcare providers are subject to the Privacy Act 1988 and the Australian Privacy Principles (APPs), which require that personal health information be protected with appropriate technical and organisational safeguards.
Network segmentation that separates patient data from patient-accessible Wi-Fi, combined with access control to clinical servers, directly supports APP 11 (security of personal information) requirements. For practices pursuing accreditation — AGPAL, QPA, or similar — a segmented network with documented access controls is generally expected and may be assessed during audit.
The ACSC Essential Eight provides a practical baseline for the technical controls required. A properly segmented clinic network with FortiGate IPS, access controls, and patching processes typically covers Essential Eight Maturity Level 1 for network-related controls.
What It Takes to Implement
A VLAN segmentation project for a typical single-site medical clinic (4–8 consulting rooms, 10–20 staff) typically involves:
- A managed switch that supports 802.1Q VLAN tagging (Aruba 2530 or Ubiquiti USW Pro)
- A FortiGate firewall with inter-VLAN routing and security profiles configured
- Aruba access points (AP-505 or AP-515) for clinical and patient Wi-Fi
- Configuration of all 6 VLANs, firewall rules, QoS policy, and Wi-Fi SSIDs
- Testing of clinical application access, device connectivity, and patient Wi-Fi isolation
For a single-site clinic, this is typically a one-day project with a planned after-hours cutover to minimise disruption. Multi-site projects require site-by-site rollout with test periods at each site before the next.