I want patient Wi-Fi — how do I separate it safely? — answered by Engineer Saeed Baatiah
The patient network must be fully isolated from the work network, not merely on a different password. An infected patient device on your internal network can see your machines, servers and medical records. The correct setup: a separate guest network with isolation between the connected clients themselves, a speed cap so video streaming does not consume your operational bandwidth, and no access to any internal device.
Real separation is three layers rather than a different password: a guest network fully isolated from the internal network, isolation between the connected clients themselves so one patient device cannot see another, and blocking access to any internal address. The second layer is frequently skipped even though it prevents malware spreading between visitor devices inside your facility.
And a speed cap is not stinginess but operational protection: one patient streaming high-quality video can consume enough bandwidth to slow your clinical system if both share the line. Allocate a share to the patient network and cap per-device speed. Better still where possible, a completely separate internet line for patient Wi-Fi — the simplest and safest answer.
And before going live: put up a welcome page stating the terms of use, and use a password rotated periodically or a temporary-code system. A fully open network gets used from outside the building and becomes a drain on your line with no benefit to your patients.
- Three layers: isolation from internal, between clients, and from internal addresses
- Per-device speed cap — one stream can slow your clinical system
- A separate line for patients if possible: simplest and safest