Zero trust in hospital IT is stalling for 82% of systems
7 min read
Adopting zero trust in hospital IT is a grinding, half-finished migration where marketing promises clash with legacy clinical infrastructure.
Consider a representative mid-sized surgical wing where an anesthesiologist is preparing for an emergency cesarean section. The patient is hemorrhaging, the room is tense, and the clinician needs immediate access to the anesthesia workstation to monitor vital signs. Under a newly deployed, strict identity-verification policy, the workstation demands a multi-factor authentication prompt. However, the hospital's deep concrete basement blocks cellular signals, and the clinician's token generator is in a locker down the hall. The workaround is immediate, human, and entirely predictable: a shared emergency credential written on a faded strip of tape stuck to the underside of the keyboard drawer.
This is where the neat slides of cybersecurity architects meet the messy reality of clinical medicine. We are told that zero trust is an absolute necessity—a seamless transition to a world where no device or user is trusted by default. Yet, as cybersecurity buyers prepare for the HIMSS26 Europe conference in Copenhagen, a survey of 284 European hospital cybersecurity buyers by Black Book Research reveals a stark shift in perspective. A striking 82% of respondents now rate their concern over cyberattacks as very high or extreme, driven not by the fear of data privacy fines, but by the immediate threat of care disruption and the collapse of clinical continuity.
The Friction Between Clinical Workflows and Zero-Trust Mandates
The industry consensus, pushed heavily by enterprise security vendors, is that hospitals must rapidly implement microsegmentation and continuous identity verification. This view assumes that a clinical network behaves like a corporate office. In an office, a delayed login or a blocked network port is an annoyance; in an emergency department, a delayed login is a clinical risk. When security tools introduce latency into clinical workflows, clinicians do not adapt—they route around them.
This conflict is particularly acute within the clinical core. Corporate IT environments rely on software agents installed on endpoints to verify device health before granting access. But in a hospital, the most critical endpoints are medical devices. You cannot install a CrowdStrike or SentinelOne agent on a million-dollar Siemens Healthineers MRI machine or a Philips telemetry monitor. Doing so would void the operating parameters cleared by regulatory bodies like the FDA or violate strict manufacturer warranties.
Consequently, hospital IT departments find themselves in a perpetual state of half-finished migration. They have successfully secured the low-hanging fruit: corporate email, billing systems, and HR portals are locked behind modern identity providers like Okta or Microsoft Entra ID. Yet, the actual clinical floor—where legacy DICOM imaging traffic and unencrypted HL7 data streams run—remains a flat, vulnerable network. It is a dual-state system: a modern, authenticated perimeter wrapped around an insecure, legacy core.
The Legacy Debt of Connected Medical Devices
The core vulnerability of modern medicine is that we are running 21st-century healthcare on late 20th-century network protocols. Many life-critical systems still rely on legacy operating systems that cannot be patched. A hospital's capital budget cycles mean that a high-end diagnostic scanner is expected to operate for fifteen years. These machines were designed to trust everything on their local network segment implicitly.
"The fundamental mistake of medical security design is assuming we can secure the endpoint, when our actual task is protecting the patient from the endpoint's inherent vulnerabilities."
Enforcing standard corporate zero-trust policies on legacy medical devices is like putting a modern smart-lock on a crumbling wooden screen door—it either breaks the door or fails to lock entirely. When an IT department attempts to segment these devices without deep, protocol-aware visibility, they risk blocking the critical telemetry streams that carry patient data to central nursing stations. The fear of causing an accidental outage often leads security teams to exempt medical devices from segmentation policies entirely, leaving the most vulnerable assets wide open to lateral movement during a ransomware attack.
Where Zero Trust Actually Holds Up
It would be a mistake to dismiss zero-trust principles entirely. The framework works exceptionally well when applied to the administrative and remote access perimeters of healthcare delivery. The shift to remote radiology, off-site billing, and third-party vendor maintenance has created an expansive attack surface that traditional VPNs can no longer safely defend.
By replacing broad-network VPNs with Zero Trust Network Access (ZTNA) solutions from vendors like Zscaler or Cloudflare, hospitals can restrict external contractors to specific applications rather than granting them access to entire subnets. For example, a field engineer logging in to service a specific laboratory analyzer should only be allowed to communicate with that single IP address on a specific port, rather than having free rein over the entire laboratory information system (LIS) network.
Figures compiled from the sources cited below.
Furthermore, identity-centric access controls are highly effective for securing cloud-hosted Electronic Health Record (EHR) systems like Epic or Cerner. When clinicians access these systems from managed, hospital-owned tablets using single sign-on and context-aware authentication, the risk of credential-harvesting attacks drops significantly. The challenge is not that zero trust is flawed; it is that we are trying to apply the same blueprint to a cloud-based database and a physical, real-time patient monitor.
| Zero Trust Pillar | The Vendor Pitch | The Clinical Production Reality |
|---|---|---|
| Identity Verification | Continuous, multi-factor authentication for every user and session. | Emergency logins must take under 3 seconds; physical badge taps (like Imprivata) must override MFA in critical care zones. |
| Microsegmentation | Isolate workloads and block all lateral movement by default. | Legacy medical protocols (DICOM/HL7) lack encryption; aggressive blocking risks dropping critical patient telemetry. |
| Device Visibility | Deploy active security agents to monitor device health in real time. | Proprietary medical operating systems reject third-party agents; hospitals must rely on passive network listening. |
The Pragmatic Path to Clinical Continuity
If we accept that a complete, end-to-end zero-trust architecture is currently impossible in clinical environments, we must adopt a more pragmatic, systems-based approach. We must focus on unglamorous, high-yield defensive measures that protect patient care without interrupting the clinicians who deliver it.
- Passive Network Profiling: Before attempting to segment a clinical network, hospitals must use passive, medical-grade discovery tools (such as Medigate by Claroty or Ordr) to map every communication path. This allows security teams to understand what a device is actually doing before they write a policy that might silence it.
- Audited Emergency Bypasses: Security systems must include built-in, physical "break-glass" protocols. In life-or-death scenarios, clinicians must be able to bypass authentication hurdles instantly, with the understanding that these exceptions are logged and audited within 24 hours.
- Strict Supplier and Patch Management: Under regulatory frameworks like Europe's NIS2 Directive, hospitals must demand Software Bills of Materials (SBOMs) from medical device manufacturers. We must hold OEMs accountable for providing timely security patches throughout the operational lifespan of their machines.
The transition to a secure clinical network will not be achieved through a single, heroic software deployment. It will be won through the slow, methodical work of understanding clinical workflows, mapping legacy dependencies, and accepting that sometimes, the most secure system is the one that knows when to get out of the clinician's way.
Frequently Asked Questions
How do we enforce zero trust on legacy infusion pumps that don't support modern identity protocols?
You cannot enforce identity verification directly on these endpoints. Instead, you must isolate them at the network level using virtual local area networks (VLANs) and access control lists (ACLs) that restrict their communication exclusively to the specific clinical monitoring servers they require, blocking all lateral access to the broader corporate network.
What happens to NIS2 compliance when our clinical staff routinely bypass MFA during a medical emergency?
NIS2 and other regulatory frameworks prioritize patient safety and operational resilience over rigid policy adherence. Under audit conditions, documented "break-glass" procedures that are automatically logged, reviewed, and justified by clinical necessity are generally accepted as valid risk-mitigation controls rather than compliance failures.
Can passive network monitoring tools replace active microsegmentation in a clinical environment?
Passive monitoring tools cannot block attacks on their own, but they are an indispensable prerequisite. They provide the precise traffic visibility needed to design safe, clinical-grade microsegmentation policies without risking accidental disruption to patient care systems.
How do we handle third-party vendor access for remote device maintenance without creating backdoor entry points?
Hospitals should mandate the use of zero-trust network access (ZTNA) solutions that grant temporary, session-limited access to specific device IP addresses and ports, rather than providing broad, persistent site-to-site VPN tunnels that can be exploited if the vendor's own network is compromised.
The Reality on the Hospital Floor: True security in healthcare is not about achieving a perfect zero-trust score on a vendor's dashboard. It is about ensuring that when a system is compromised, the failure is graceful, localized, and entirely separated from the machines that keep patients alive. The ultimate metric of hospital cybersecurity is not data locked down, but care delivered without interruption.
When you look at your own clinical network today, do you actually know which of your connected life-support systems are currently exempt from your security policies because they are too fragile to segment?
Related from this blog
- Zero trust in hospital IT implementation steps for 2026
- FDA medical device software compliance in 2026 shifts costs
- Legacy Medical Equipment Patching: The 53% Deficit
- Does hospital network threat detection stop DICOM leaks?
- Can Connected Pacemaker Security Survive in the Clinic?
