Hospital network security India: from the ward to the clinic

A ransomware attack on one server should not stop the whole hospital. In November 2022, a cyber attack hit AIIMS New Delhi. The government told Parliament that five servers were affected and about 1.3 TB of data was encrypted. It gave the cause as "improper network segmentation", as reported from the Rajya Sabha reply. Data was restored from an unaffected backup server. The lesson for every hospital is plain. A flat network lets an attacker move from one system to all of them.

Hospitals carry more kinds of devices than most businesses. Imaging systems, infusion pumps, patient monitors and lab analysers often run old software. Many cannot take a security agent. They stay in service for years. The network around them has to do the protecting.

Your network should reflect who needs to reach what. Here is a typical zone design. Each zone gets its own VLAN or VRF, and the zone firewall allows only the flows your policy lists.

Nexapp's IoT/OT security discovers devices behind every router and restricts each one to the systems it needs. IPS and gateway antivirus inspect traffic between zones. See NGFW.

A clinic that loses its link cannot look up a patient record or post a bill. Nexapp SD-WAN connects hospitals, clinics, diagnostic labs and sample-collection centres under one encrypted overlay.

• Two paths at every site. Broadband or leased line, plus 4G/5G on a dual-SIM Instaroute router. SLA probes move clinical and billing traffic to the healthy link in under a second.
• New clinics online on day 1. Zero-touch provisioning brings a router online with its full configuration at power-on, over cellular, before fibre arrives.
• Application-aware steering. HIS, EMR and video consultations take the best path; bulk transfers take the cheaper one.
• Encrypted end to end. Every IPsec IKEv2 tunnel uses hybrid post-quantum key exchange (ML-KEM, NIST FIPS 203). Health records stay confidential for decades, so this protects recorded traffic against harvest-now, decrypt-later attacks.
• One console for every site, from a 500-bed hospital to a two-room collection centre.

See SD-WAN Enterprise, 5G wireless SD-WAN and the router catalogue.

A visiting consultant needs the PACS viewer, not the whole hospital network. With Nexapp SSE and the InstaAccess client, each user reaches only the applications their policy allows. Device posture is checked before access and during the session. Passkey sign-in resists phishing.

• Doctors reporting from home reach the reporting application only.
• Equipment vendors reach the specific modality or analyser they maintain, and every session is logged.
• Billing and back-office staff get the same web and data-protection policy at home as in the hospital.

The same client supports SSL VPN and IPsec VPN, so you can move applications to ZTNA one at a time. See SSE/ZTNA and secure remote access.

Patients and families expect Wi-Fi, and it must never touch clinical systems. Nexapp runs staff and guest Wi-Fi on the same secured edge as your SD-WAN and firewall. Guest traffic goes to its own SSID and VLAN, with per-SSID isolation and QoS, so it cannot crowd out clinical traffic. InstaWave adds a captive portal for visitors. For staff, the Nexapp Controller provides RADIUS for Wi-Fi, wired 802.1X and captive-portal sign-in. Router Wi-Fi is dual-band Wi-Fi 6 on the IRX100 5G models. Ask us about access points for large wards and campuses. See Enterprise Wi-Fi.

The obligations sit with the hospital or clinic. No regulator certifies a network vendor. Here is how the network helps you meet the rules that apply.

Health data is personal data under the DPDP Act. The Act does not require all data to stay in India, but CERT-In's log rule does. Our management and logs stay in India when we host them, and in your data centre when you self-host.

1. Map. List your applications, device groups, sites and remote-access needs.
2. Design. Define zones and allowed flows, choose the edge for each site and plan the links.
3. Deploy. Devices come online zero-touch; our field teams install where needed.
4. Secure. Apply zone policy, IPS, web filtering and ZTNA rules centrally.
5. Operate. Our 24×7 NOC in Pune monitors links and devices, or your team runs it with alarms and reports.

Buying for a government hospital? Public hospitals and medical colleges often buy under the Public Procurement (Preference to Make in India) Order. Nexapp is a Class-I local supplier, and you get a local-content declaration and certificate with each bid. See certifications.