Segmenting Imaging and Medical Devices at a Northeast Houston Orthopedic Group
Imaging equipment running end-of-life operating systems shared one flat network with every workstation. Segmentation isolated the devices without taking a single clinic day offline.
At a glance
2 locations · 8 providers · 61 staff
The challenge
The group's C-arm, two DR imaging suites, and a PACS appliance ran vendor-locked operating systems that could not be patched without voiding support contracts. All of it sat on the same flat network as staff workstations, guest Wi-Fi, and the EHR. A penetration test reached the PACS appliance from the guest network in under an hour.
- 31 devices on end-of-life, vendor-locked operating systems
- Flat network — guest Wi-Fi reachable to clinical systems
- Penetration test reached PACS from guest Wi-Fi in 47 minutes
- Any downtime meant cancelled surgical scheduling
What we did
- 1
Passive device discovery
We fingerprinted every device on the network passively — active scanning can crash older medical devices — and built an inventory with each device's actual required communication paths.
- 2
Segmentation design against real traffic
VLANs and firewall policy were designed from 30 days of observed flows, so the rules permitted what clinicians actually use rather than what the vendor documentation claimed.
- 3
Compensating controls for unpatchable devices
Devices that cannot be patched were placed behind deny-by-default policy with logging, which is the documented compensating control OCR expects when a technical safeguard is not achievable as written.
- 4
Phased cutover outside clinic hours
Cutover ran across four weekend windows with a tested rollback at each stage. No surgical scheduling was affected.
- 5
Re-test to prove the control
The same penetration test was re-run post-cutover. The paths that reached PACS previously were closed, and the evidence was filed with the risk analysis.
The outcome
The group meets the network segmentation expectation in the 2026 Security Rule NPRM ahead of the compliance date, with a re-test report proving the control works rather than a diagram claiming it does.
Our imaging vendor said segmentation would break the equipment. Designing it from thirty days of real traffic is why it didn't.
Services used in this engagement
More case studies
Client identities are protected under our Business Associate Agreements. These engagement stories are anonymised composites drawn from real Atascocita IT audits of the practice type described; metrics reflect the documented outcomes of those engagements.