医院 WiFi 安全吗？患者和访客应该了解的事项

Network Segmentation

将计算机网络拆分为子网络以提高性能和安全性的实践。

在医院中至关重要，以确保患者 WiFi 流量无法访问临床 EHR 系统或医疗设备。

Client Isolation

一种无线网络安全功能，可防止连接到同一接入点的设备相互通信。

用于访客网络，以防止横向攻击和对等恶意软件传播。

WPA3

最新一代的 WiFi 安全技术，提供强大的身份验证和个性化数据加密。

取代 WPA2，为无线网络提供更好的防御暴力破解字典攻击的保护。

Captive Portal

公共访问网络用户在获得访问权限之前，必须查看并与之交互的网页。

由 IT 团队用于强制执行服务条款、捕获身份数据并确保符合法规监管。

Rogue Access Point

在未获得本地网络管理员明确授权的情况下，安装在安全网络上的无线接入点。

一个主要的威胁向量；IT 团队使用 WIPS 来检测和遏制这些设备，以防止数据拦截。

VLAN (Virtual Local Area Network)

对来自不同物理局域网的设备进行分组的逻辑子网。

用于将访客流量与临床网络隔离的基础技术。

OpenRoaming

一种漫游联盟服务，可实现自动且安全的 WiFi 体验。

允许患者使用基于配置文件的身份验证安全连接，无需输入密码。

DNS Filtering

使用域名系统阻止恶意网站并过滤掉有害或不当内容的过程。

在访客网络上实施，以保护用户免受恶意软件侵害，并免除医院的法律责任。

Is hospital WiFi safe for patients and visitors to use?

Yes, modern hospital guest WiFi is safe for patients and visitors when designed with enterprise network segmentation and client isolation. Hospitals separate guest and patient traffic onto isolated virtual LANs (VLANs) that cannot route packets to clinical local area networks, electronic health record (EHR) databases, or medical telemetry equipment. When connecting to public hospital networks, patients should ensure websites use HTTPS (TLS encryption) and avoid downloading unverified profiles or certificates.

What technical controls prevent patient devices from accessing clinical medical systems?

Healthcare network architects enforce multi-layer isolation between visitor and clinical systems. Access points apply layer 2 client isolation (Private VLANs or station separation), preventing devices on the patient network from communicating with one another. Upstream firewalls enforce strict access control lists (ACLs) that drop all traffic destined for internal RFC 1918 clinical subnets, while dedicated DNS resolvers filter malicious domains and enforce content categories in compliance with NHS DSPT and HIPAA security safeguards.

Can other patients or hackers on hospital WiFi see my medical records or browsing data?

No, other users on the network cannot access your confidential medical records or view encrypted browsing traffic. Medical records reside within secure hospital intranet zones protected by firewalls, 802.1X authentication, and role-based permissions, completely inaccessible from guest subnets. Furthermore, over 95 percent of modern web traffic uses end-to-end Transport Layer Security (HTTPS/TLS 1.3), encrypting URLs, form submissions, and patient portal sessions against eavesdropping even on unencrypted open wireless links.

How do WPA3 Opportunistic Wireless Encryption and Passpoint protect hospital visitors?

Traditional open WiFi networks transmit data frames unencrypted over the air. Modern healthcare venues deploy WPA3 Opportunistic Wireless Encryption (OWE, RFC 8110) or Passpoint (Hotspot 2.0). OWE provides individualized cryptographic encryption keys for each connected patient device without requiring a shared password, preventing over-the-air packet sniffing. Passpoint automates secure 802.1X authentication and profile installation, delivering seamless connectivity while defending against rogue evil twin access points.

How does Purple help healthcare trusts and hospitals deliver compliant patient WiFi?

Purple provides cloud-managed guest WiFi software designed specifically for healthcare environments, supporting NHS England WiFi standards, HIPAA compliance, and DSPT requirements. Purple automates patient captive portal onboarding with NHS login integration, provides content filtering, enforces fair airtime limits to safeguard network capacity, and delivers real-time venue footfall analytics without collecting protected health information (PHI).