Care home WiFi provider checklist: residents, visitors, staff and safeguarding filters

A care home WiFi provider should deliver four things: a private network for each resident's devices, a simple visitor sign-in at the front door, an identity-based network for care staff and clinical devices, and filtering set per network that protects vulnerable adults without blocking family video calls. Purple runs all four on your existing access points.

What does a care home WiFi provider actually need to deliver?

A care home is three places under one roof. It is a home for residents, a workplace for care staff and a clinical setting with its own devices. One shared password cannot serve all three safely. A good care home WiFi provider separates them and gives each the right access, security and filtering.

The test is simple to state. A resident's tablet should reach their daughter on WhatsApp at 8pm on a Sunday. A visitor should get online in under a minute at reception. A night nurse should open the digital care record without typing a password. None of these groups should see each other's devices or traffic.

The 4 networks and who uses each

Network	Who uses it	How they connect	Filtering policy	Isolation
Resident	Residents and the devices families bring: tablets, smartphones, smart speakers, smart TVs	Individual key per resident (iPSK), no captive portal	Light: illegal content, malware and phishing blocked; calling and streaming allowed	Each resident's devices on their own private network
Visitor	Family, friends, visiting professionals, contractors	Captive portal sign-in via QR code at reception	Public-space policy: adult content, illegal content and malware blocked	Separate VLAN, no access to resident or staff devices
Staff	Permanent and agency care staff, managers, admin teams	IEEE 802.1X login with their work identity	Workplace policy set by your care group	Separate VLAN, access removed when the person leaves
Clinical and building devices	Digital care record tablets, nurse call units, acoustic monitors, falls sensors	Device-specific key (iPSK) where 802.1X is unsupported	Allow-list: only the services each device needs	Own VLAN, isolated from every other network

A VLAN (virtual local area network) splits one physical network into separate logical networks. Traffic on one cannot reach another without a rule allowing it.

Purple delivers this through Identity-Based Networks. Every connection belongs to a named person or device, not a shared password. Multi-Tenant WiFi covers residents, Guest WiFi covers visitors, Staff WiFi covers your teams, and Shield applies filtering per network. For wider context, see how Purple approaches Healthcare settings.

What do you need before you start?

Gather six things before you speak to any provider. They decide your timeline more than any feature list.

1. An access point inventory for every home. Record the make and model at each site. Purple runs as a hardware-agnostic cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Most care groups can keep the hardware they own. Read why your next WiFi upgrade doesn't need new hardware before you approve a replacement budget.
2. A coverage picture of resident rooms. Fire doors, thick internal walls and long corridors weaken the signal in bedrooms. Many homes patched this with plug-in extenders, which cause problems with modern authentication. Compare the options in WiFi extender vs access point: which one do you need?.
3. Your staff identity provider. Staff WiFi authenticates against Microsoft Entra ID, Okta or Google Workspace. Confirm who manages accounts and how agency staff get one.
4. A device list by network. List the resident devices families bring, plus every clinical and building device. Note which clinical devices support 802.1X and which only accept a password.
5. Your data protection paperwork. Visitor sign-in collects personal data, and residents are often vulnerable adults. Complete a data protection impact assessment (DPIA) under UK GDPR Article 35. If you submit the NHS Data Security and Protection Toolkit (DSPT), list the evidence you will need from the provider.
6. A named filtering owner. Your safeguarding lead and home manager should sign off each filtering policy together. That decision sits with the people who know your residents, not the IT supplier.

How do you set up resident, visitor and staff networks?

The order below suits most care groups. Residents come first because their devices are the hardest to move and the most visible when they fail.

Step 1: Give each resident a private network without a shared password

Use iPSK, short for identity pre-shared key. Some vendors call it PPSK (private pre-shared key). Each resident receives their own WiFi key, and every device using that key joins the resident's own private network. Purple calls this a Private Area Network, or PAN: a private network bubble around one person's devices.

iPSK suits care homes for three reasons:

• It works with devices that cannot use a captive portal. Smart speakers, smart TVs and simplified tablets cannot complete a web sign-in page. They all accept a standard WiFi password.
• Residents never share a password. One resident's key cannot connect to another resident's devices. A neighbour's tablet cannot see a resident's smart speaker.
• Admission and departure are a single action. Issue the key when a resident moves in. Revoke it when they leave or pass away, without touching anyone else's devices.

Print each resident's key on a card for the family. When a daughter brings a new tablet, she types the same key once and it joins her mother's private network.

Step 2: Put visitors through a simple sign-in at the front door

A captive portal is the web page a visitor sees before they get online. Put a QR code at reception and in the lounge or café. The code opens the sign-in page directly, so visitors never hunt for a network name.

Keep the form short: name, email and acceptance of your terms. Use conscious-choice opt-ins for any newsletter or event updates, unticked by default, to meet UK GDPR consent rules. Set the session length to match your visiting hours, so a family visiting each afternoon is not asked to sign in mid-visit.

Purple's Guest WiFi handles this sign-in, the same way it does for visitors in Hotels. Cap bandwidth per visitor session so a busy Sunday never slows a resident's video call.

Step 3: Put care staff and clinical devices on a secure network

IEEE 802.1X is the standard that makes each device prove who it is before it joins. A RADIUS server checks those credentials against your identity provider. Purple provides cloud RADIUS, so you run no server at each home.

Staff log in once with their work identity from Microsoft Entra ID, Okta or Google Workspace. This settles joiners, movers and leavers (JML). A new starter gets access when their account is created. A leaver loses it when their account is disabled. Nobody changes a password on the wall of the staff room.

Agency staff need the same treatment. Create time-limited accounts for agency staff in your identity provider. Their access ends with the account, not when someone remembers to change a password.

Clinical devices often cannot use 802.1X. Give each device type its own iPSK key on its own VLAN. A compromised smart TV on the resident network then has no route to a nurse call unit.

Step 4: Set safeguarding filters per network

Filtering for vulnerable adults is not the same as filtering for children. The Mental Capacity Act 2005 starts from a presumption that adults have capacity. It also requires the least restrictive option. A blanket block on a resident's network can breach those principles and cut residents off from family.

Shield applies a different policy to each network. Use this matrix as your starting point, then let your safeguarding lead adjust it.

Content category	Resident network	Visitor network	Staff network	Clinical devices
Illegal content	Block	Block	Block	Block
Malware and phishing sites	Block	Block	Block	Block
Adult content	Allow (residents' own rooms)	Block	Block	Block
Gambling	Allow	Block	Block	Block
Video calling (WhatsApp, FaceTime, Zoom, Microsoft Teams)	Allow	Allow	Allow	Block
Streaming (BBC iPlayer, YouTube)	Allow	Allow	Allow	Block
Care record and nurse call services	Not applicable	Not applicable	Allow	Allow-list only

Where one resident needs extra protection, such as a recorded risk of financial abuse, record a best-interests decision in their care plan. Apply the restriction on that resident's own device with the family's agreement. A whole-network rule should not penalise every other resident for one person's risk.

Ask any provider whether its filtering blocks the Internet Watch Foundation's list of child sexual abuse URLs. Make it a written answer in your tender.

Worked scenarios

Both scenarios below are planning examples. The outcomes come from the design itself, so you can measure the same results in your own homes.

Worked scenario 1: a council-run supported living scheme

Situation. A local authority runs a supported living scheme with 24 flats and a shared lounge. Residents, staff and visitors all use one password. When a support worker left, the scheme changed the password. Every resident's tablet and smart speaker dropped off, and three residents missed calls with family that evening.

What was done. The scheme moved residents to Multi-Tenant WiFi with an iPSK key per flat. Staff moved to 802.1X against Microsoft Entra ID. Visitors moved to a QR-code captive portal at the entrance. Shield applied the resident, visitor and staff policies above.

Measurable outcome. Shared passwords fell from one, known to everyone, to zero. The next staff leaver lost access the moment their account was disabled. No resident device needed re-keying. The scheme's supported living WiFi now gives each tenant the separation they would expect in their own flat.

Worked scenario 2: a nursing home with a family café and a summer fete

Situation. A 70-bed nursing home runs a café open to families and hosts a summer fete with about 150 attendees. Visitors had been given the staff password at reception. On fete day, the network slowed and care staff struggled to update digital care records.

What was done. The home split visitors onto Guest WiFi, with QR codes at reception, in the café and on fete signage. It capped bandwidth per visitor session and applied Shield's public-space policy. Staff and clinical devices moved onto their own VLANs with 802.1X and device-specific keys.

Measurable outcome. The staff password stopped circulating among visitors. Fete traffic stayed on the visitor network and away from clinical devices. The home manager now reads monthly visitor sign-ins in WiFi Analytics and uses them to plan staffing for busy visiting days.

How do you check it works?

Run an acceptance test at the pilot home before anyone signs off. Do it in the evening, when residents make most of their family calls.

• Resident connection. Connect a tablet and a smart speaker with one resident's key in their room. Walk the tablet to the lounge and back. It should stay on the same private network throughout.
• Resident isolation. From a second resident's key, try to discover the first resident's smart speaker. It should not appear.
• Visitor sign-in. Scan the reception QR code on an iPhone and an Android phone. Time it. Visitors should be online in under a minute.
• Staff joiner and leaver. Create a test account, connect, then disable it. The device should lose access without anyone touching the access points.
• Clinical isolation. From the visitor and resident networks, try to reach a nurse call unit. Both attempts should fail.
• Filtering. On each network, test one blocked category and one allowed category. Make a WhatsApp video call and a FaceTime call from the resident network.
• Coverage. Measure signal in the five rooms furthest from an access point, with fire doors closed.

What goes wrong, and how do you fix it?

Resident devices drop off after a hardware change

Older devices sometimes fail when a network moves to WPA3 or to 5 GHz only. Keep the resident network on settings those devices support. Plan WPA3 for staff and clinical networks first.

Smart speakers cannot get past the sign-in page

Someone put resident devices on the visitor captive portal. Move them to the resident's iPSK key. Captive portals are for people with a browser, not for speakers or TVs.

A filter blocks a family video call

An over-broad category, such as "social networking", caught a calling app. Allow named calling services explicitly on the resident and visitor networks. Re-test after every filtering change.

Plug-in extenders cause dropouts in bedrooms

Extenders rebroadcast the signal and often handle per-device keys and 802.1X poorly. Replace them with properly placed access points. If you are refreshing hardware anyway, WiFi 6 (802.11ax) explained covers the capacity gains in busy lounges.

Families install their own router in a resident's room

A second router creates interference and a security gap. Show the family that the resident's private network already gives them their own secure connection. Then agree removal with them.

Agency staff cannot log in on their first shift

Their account was not created in time. Make agency account creation part of your booking process, with a named owner at each home.

What should the contract say about support hours and site-by-site rollout?

Care runs around the clock, so your contract must too. Use this table as your clause checklist.

Clause	What to ask for	Why it matters in a care home
Support hours	24/7 support for loss of service on resident, staff or clinical networks	Residents call family in the evening; night staff need care records at 3am
Severity levels	Written response and resolution targets in hours for each severity level	Turns "we'll look into it" into a commitment you can enforce
Platform availability	A stated uptime percentage in the schedule; Purple's is 99.999%	Every hour of downtime is a missed call or a delayed care note
Rollout plan	One pilot home, then waves with a named go-live date per site	Lets you prove the design before it reaches every home
Supported hardware	A named list of supported access point models for every site	Avoids a surprise hardware bill halfway through rollout
Data protection	Data processing agreement under UK GDPR Article 28 and a named data location	Required when a provider processes visitor and resident data for you
Certifications	In-date ISO 27001 and Cyber Essentials certificates	Evidence for your DPIA and DSPT submission
Filtering changes	A set turnaround for safeguarding-led policy changes	A safeguarding decision should not wait in a general ticket queue
Exit	Export of configuration and visitor data in a standard format	Keeps you free to change provider later

Roll out site by site. Start with a home that has a cooperative manager and a typical building. Fix what the pilot teaches you, then move in waves of three or four homes. If you are replacing an existing care home WiFi provider, follow switching guest WiFi providers: a migration checklist for multi-site venues.

What does it cost, and what do you get back?

Four things drive cost: the number of homes, the plan, the add-ons and any hardware gaps. Purple offers three plans, Connect, Capture and Engage. Shield is an add-on for filtering. Because Purple layers on top of your existing access points, most of the work is configuration rather than installation.

Your hardware survey decides the rest. A home with good access point coverage needs no capital spend. A home relying on extenders needs access points in the weakest rooms.

The return shows up in three places:

• Staff time. Shared-password changes stop. Picture a home with 40 resident devices and a password change after each leaver. Re-keying every device takes hours of carer time that iPSK and 802.1X remove.
• Safeguarding evidence. You can show an inspector a written filtering policy per network, signed by your safeguarding lead. You can also show who accessed the staff network, and when.
• Resident and family wellbeing. Reliable residential care WiFi keeps residents in touch with family. Visitor sign-in data in WiFi Analytics shows which homes families visit most, and when.

Purple runs on more than 80,000 live venues in over 90 countries and handles 500 million users and logins a year, according to Purple's own data. The platform is ISO 27001, GDPR, CCPA, Cyber Essentials and B Corp certified.

Frequently asked questions

Can Purple run on the access points we already have in our care homes?

Yes, Purple runs as a cloud overlay on your existing access points. Supported vendors include Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You keep your hardware and add resident, visitor and staff networks on top. A survey may still show weak coverage in some bedrooms. In that case, you add access points to those rooms rather than replacing the whole network.

How do residents keep their devices connected without sharing a password?

Each resident gets their own WiFi key using iPSK, which places all their devices on a private network. Families enter the key once on any tablet, smart speaker or TV. No resident ever shares a password with another, and no neighbour can see their devices. When a resident leaves, you revoke that one key. Every other resident's devices stay connected without any change.

Will safeguarding filters block residents' video calls with family?

No, not when filtering is set per network. Shield applies a light policy to the resident network. It blocks illegal content, malware and phishing while allowing WhatsApp, FaceTime, Zoom and Microsoft Teams. Visitor and staff networks get stricter policies. Where one resident needs extra protection, record a best-interests decision under the Mental Capacity Act 2005. Then apply the restriction on their own device.

How is visitor and resident data handled under UK GDPR?

Purple is GDPR compliant and holds ISO 27001 and Cyber Essentials certification. Visitors give consent through conscious-choice opt-ins that are unticked by default. Your contract should include a data processing agreement under UK GDPR Article 28. You should also complete a DPIA, because residents are vulnerable adults. If you submit the NHS DSPT, ask Purple for the certification evidence you need.

Can agency staff use the staff network without a shared password?

Yes, agency staff log in with their own time-limited account from Microsoft Entra ID, Okta or Google Workspace. Staff WiFi authenticates them through IEEE 802.1X and Purple's cloud RADIUS. Their access ends when the account expires or is disabled. Nobody needs to change a password or reconnect other devices. Build account creation into your agency booking process, so access is ready before the first shift.

How long does a rollout take across a care group?

Rollout length depends mostly on configuration and your hardware survey, not on installation. Purple layers onto existing access points, so homes with good coverage need no new equipment. Start with one pilot home and run the full acceptance test, including evening video calls. Then roll out in waves of three or four homes. Put a named go-live date for each site in your contract.

How do we switch from our current care home WiFi provider?

You switch site by site, running the old and new networks side by side during each cutover. Start with an inventory of access points, network names and resident devices at every home. Issue resident keys before cutover, so families can reconnect devices in one visit. Move staff to 802.1X, then retire the shared passwords. Purple's multi-site migration checklist sets out each stage in order.