為什麼 iPSK 是安養機構 WiFi 的未來：平衡住民隱私與醫療安全

Standard enterprise WiFi (802.1X / WPA-Enterprise) requires individual username and password logins or 802.1X certificate installations. Headless consumer devices commonly used by care home residents - such as smart TVs, Amazon Alexa speakers, digital photo frames, and tablets - lack web browsers and certificate stores, causing them to fail authentication. Identity PSK (iPSK) solves this by allowing headless devices to connect using standard WPA2/WPA3 pre-shared keys while still assigning unique, isolated credentials to each resident.

Identity PSK generates a unique, private passphrase for each resident room. When a resident enters their key on their smart TV, tablet, or voice assistant, the wireless controller assigns those devices into a private Personal Area Network (PAN) bubble. Devices within the same room communicate locally via filtered mDNS, allowing residents to cast video and play music without exposing their devices to the wider facility network or neighboring rooms.

Network micro-segmentation isolates clinical devices onto dedicated VLANs with strict firewall rules and 802.1p Quality of Service (QoS) priority. Care staff tablets running electronic medication administration records (e-MAR) and Digital Social Care Records receive guaranteed airtime and bandwidth. This prevents high-bandwidth resident streaming or visitor traffic from delaying critical medication updates and prevents unauthorized access to sensitive patient health data.

Under a traditional shared WiFi password, all devices sit on the same broadcast domain, allowing residents or visitors to accidentally stream video to the wrong room's TV. With iPSK and PAN micro-segmentation, Layer 2 client isolation blocks cross-room discovery and casting. Residents only see and control the specific devices associated with their own room passphrase.

Care home administrators no longer need to manually configure device MAC addresses or manage complex router hardware. When a resident moves in, Purple generates an onboarding key that can be provided to family members. If a resident transfers rooms or moves out, their unique key is revoked instantly in the portal or via care management system webhooks, leaving all other residents completely unaffected.

The Care Quality Commission (CQC) and NHS Data Security and Protection Toolkit (DSPT) require care providers to protect digital records with encrypted wireless transport, access control audits, and strict segregation between public guest access and clinical health record systems. Deploying enterprise APs with isolated clinical SSIDs and dynamic iPSK authentication satisfies DSPT requirements by ensuring sensitive care logs cannot be intercepted.