醫院 WiFi 安全嗎？病患與訪客應該知道的事項

Network Segmentation（網路分割）

將電腦網路分割成多個子網路以提高效能和安全性的做法。

在醫院中至關重要，可確保病患 WiFi 流量無法存取臨床 EHR 系統或醫療裝置。

Client Isolation（用戶端隔離）

一種無線網路安全功能，可防止連接到同一個無線基地台的裝置彼此通訊。

用於訪客網路，以防止橫向攻擊和點對點惡意軟體擴散。

WPA3

最新一代的 WiFi 安全技術，提供強大的驗證與個人化數據加密。

取代 WPA2，為無線網路上的暴力破解字典攻擊提供更好的保護。

Captive Portal（強制網路入口）

公用存取網路的使用者在獲得存取權限之前，必須查看並進行互動的網頁。

IT 團隊用來強制執行服務條款、收集身分數據並確保符合法規規範。

Rogue Access Point（流氓無線基地台）

在未經本地網路管理員明確授權的情況下，安裝在安全網路上的無線基地台。

一個主要的威脅媒介；IT 團隊使用 WIPS 來偵測並遏制這些裝置，以防止數據被攔截。

VLAN (Virtual Local Area Network)

一個邏輯子網路，將來自不同實體區域網路的裝置群組在一起。

用於將訪客流量與臨床網路隔離的基礎技術。

OpenRoaming

一種漫遊聯盟服務，可提供自動且安全的 WiFi 體驗。

允許病患使用基於設定檔的驗證方式安全連接，無需輸入密碼。

DNS Filtering（DNS 過濾）

使用網域名稱系統阻擋惡意網站並過濾掉有害或不當內容的過程。

在訪客網路上實施，以保護使用者免受惡意軟體侵害，並免除醫院的法律責任。

Is hospital WiFi safe for patients and visitors to use?

Yes, modern hospital guest WiFi is safe for patients and visitors when designed with enterprise network segmentation and client isolation. Hospitals separate guest and patient traffic onto isolated virtual LANs (VLANs) that cannot route packets to clinical local area networks, electronic health record (EHR) databases, or medical telemetry equipment. When connecting to public hospital networks, patients should ensure websites use HTTPS (TLS encryption) and avoid downloading unverified profiles or certificates.

What technical controls prevent patient devices from accessing clinical medical systems?

Healthcare network architects enforce multi-layer isolation between visitor and clinical systems. Access points apply layer 2 client isolation (Private VLANs or station separation), preventing devices on the patient network from communicating with one another. Upstream firewalls enforce strict access control lists (ACLs) that drop all traffic destined for internal RFC 1918 clinical subnets, while dedicated DNS resolvers filter malicious domains and enforce content categories in compliance with NHS DSPT and HIPAA security safeguards.

Can other patients or hackers on hospital WiFi see my medical records or browsing data?

No, other users on the network cannot access your confidential medical records or view encrypted browsing traffic. Medical records reside within secure hospital intranet zones protected by firewalls, 802.1X authentication, and role-based permissions, completely inaccessible from guest subnets. Furthermore, over 95 percent of modern web traffic uses end-to-end Transport Layer Security (HTTPS/TLS 1.3), encrypting URLs, form submissions, and patient portal sessions against eavesdropping even on unencrypted open wireless links.

How do WPA3 Opportunistic Wireless Encryption and Passpoint protect hospital visitors?

Traditional open WiFi networks transmit data frames unencrypted over the air. Modern healthcare venues deploy WPA3 Opportunistic Wireless Encryption (OWE, RFC 8110) or Passpoint (Hotspot 2.0). OWE provides individualized cryptographic encryption keys for each connected patient device without requiring a shared password, preventing over-the-air packet sniffing. Passpoint automates secure 802.1X authentication and profile installation, delivering seamless connectivity while defending against rogue evil twin access points.

How does Purple help healthcare trusts and hospitals deliver compliant patient WiFi?

Purple provides cloud-managed guest WiFi software designed specifically for healthcare environments, supporting NHS England WiFi standards, HIPAA compliance, and DSPT requirements. Purple automates patient captive portal onboarding with NHS login integration, provides content filtering, enforces fair airtime limits to safeguard network capacity, and delivers real-time venue footfall analytics without collecting protected health information (PHI).