TL;DR: St. Luke’s University Health Network said identity-based healthcare microsegmentation let it enable robotic surgery, onboard acquisitions faster, and contain ransomware blast radius across 15 hospitals, 85,000 production devices, and about 1,800 vendors, according to Elisity. The real lesson is that segmentation becomes a governance layer for operational continuity, not just a network control.
At a glance
What this is: This is a case study on hospital microsegmentation that shows how identity-based policy helped St. Luke’s move from blocking change to containing risk across a large, mixed clinical network.
Why it matters: It matters because IAM, PAM, and NHI teams increasingly need segmentation models that can govern device identity, vendor access, and operational trust without breaking care delivery.
Context
Healthcare microsegmentation is a network control that limits how far a compromise can move by tying policy to device or user identity rather than flat network reachability. In a hospital, that matters because clinical uptime, biomedical devices, and third-party access create a much denser trust surface than a normal enterprise network.
The article’s central governance gap is not a lack of security intent. It is the failure of conventional VLAN and firewall models to contain risk without slowing clinical work, onboarding acquisitions, or supporting devices that cannot tolerate agents or re-IP. That makes the identity layer part of operational resilience, not just access control.
Key questions
Q: What fails when hospital segmentation still depends on VLANs and IP trust?
A: It fails when the network is too large and too mixed for static zones to contain risk. VLAN-based segmentation often breaks down because it needs readdressing, extra hardware, and long implementation cycles, which leaves clinical and biomedical traffic in overly broad trust zones. The result is that a single compromise can still move laterally across critical systems.
Q: Why does microsegmentation matter for clinical continuity, not just security?
A: Because hospitals need controls that limit blast radius without stopping robotic surgery, acquisitions, or vendor-supported care. When segmentation is identity-based and tested before enforcement, security can contain compromise while still allowing the specific clinical communications the workflow requires. That is why the control becomes part of resilience, not just risk reduction.
Q: What are the warning signs that a hospital network is still too flat?
A: Common signs include broad east-west reachability, dependence on undocumented vendor connections, long delays to onboard acquired sites, and a security team that can only block rather than safely approve change. If a compromised endpoint can still talk widely across the estate, the network is not segmented enough for modern clinical risk.
Q: How should teams judge microsegmentation success in healthcare environments?
A: Success should be measured by whether the organisation can safely enable new clinical services, onboard acquisitions faster, and keep ransomware from spreading beyond the affected identity group. If segmentation reduces those risks without requiring re-IP or disruptive redesign, it is functioning as a governance control rather than a theoretical architecture.
Technical breakdown
Identity-based microsegmentation in healthcare networks
Identity-based microsegmentation classifies users, devices, and workloads by who or what they are, then applies policy based on that identity rather than on static network location. In hospitals, that matters because the same subnet can contain surgical systems, imaging devices, staff laptops, and IoT equipment with very different trust requirements. The core technical shift is from perimeter-style reachability to explicit communication allowlists tied to identity attributes and device roles. That lets teams reduce lateral movement without forcing re-architecture.
Practical implication: design policy around device identity and required communications, not around IP ranges or broad VLAN trust.
Why VLAN-based segmentation stalls in hospital environments
VLANs and firewall zones can reduce exposure, but they break down when an environment has tens of thousands of endpoints, many of them unmanaged or hard to readdress. The article shows the common failure mode: segmentation that depends on IP changes, new hardware, or long consultant-led deployments cannot keep pace with clinical operations. This is a control scalability problem, not just a tooling problem. Once the effort to segment exceeds the organisation’s tolerance for disruption, the network stays flatter than it should.
Practical implication: treat re-IP requirements and long deployment cycles as evidence that the segmentation model is not operationally fit for the environment.
Simulation before enforcement in operationally sensitive networks
Simulation is the control that changes segmentation from a guess into a governed rollout. By testing policy before enforcement, teams can see which clinical, biomedical, or vendor connections would be blocked and adjust the model before patient care is affected. In practice, this is especially important where devices cannot run agents and where outages are unacceptable. It also creates a safer path for onboarding acquired sites because policy can be validated against real traffic before go-live.
Practical implication: require pre-enforcement simulation for any segmentation policy touching clinical or third-party device traffic.
Threat narrative
Attacker objective: The attacker’s objective is to turn one foothold into hospital-wide disruption by moving laterally across devices and expanding ransomware impact.
- Entry begins on a flat or loosely segmented hospital network where one compromised device can still reach many others through broad trust relationships.
- Escalation occurs through lateral movement, because the attacker is able to move from the initial device into adjacent systems that share the same network reachability.
- Impact is a wider ransomware blast radius, which the article describes as the ability for one infected device to spread across an entire hospital instead of being contained to a small set of systems.
Breaches seen in the wild
- Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Healthcare microsegmentation has become a resilience control, not just a network hardening control. The article shows that the real governance question is whether security can preserve operational continuity while reducing lateral movement. In environments like hospitals, that changes segmentation from an architecture choice into a patient-care decision. Practitioners should evaluate segmentation by the business functions it enables safely, not only by the traffic it blocks.
Identity is now the enforcement boundary for mixed clinical environments. When a hospital must govern surgical robots, vendor equipment, staff endpoints, and guest devices on the same network, IP-based trust breaks down. This is where identity-based microsegmentation intersects with NHI governance, because devices and third-party systems behave like governed identities even when they are not human users. Practitioners should treat device identity as a first-class control plane.
Microsegmentation closes the standing trust gap created by flat networks. The article’s core failure mode is the assumption that every connected asset should be broadly reachable until something goes wrong. That assumption is incompatible with ransomware containment and with acquisition onboarding at scale. Practitioners should name this as a containment problem, not a visibility problem, and design policy to limit inherited trust from day one.
Simulation is the governance safeguard that makes enforcement tolerable. Hospitals cannot afford segmentation that surprises clinicians or biomedical teams at go-live. The article shows why safe rollout depends on policy simulation, staged enforcement, and clear ownership across security, networking, and clinical operations. Practitioners should require proof of policy impact before they accept segmentation as production-ready.
Named concept: containment continuity. This article shows that the value of microsegmentation in healthcare is not simply blocking traffic, but preserving the continuity of patient care when a device, vendor, or acquired site is compromised. That framing aligns with NIST-CSF resilience thinking and should push practitioners to judge controls by how well they limit blast radius without interrupting care.
From our research library:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
What this signals
Containment continuity: hospitals need security controls that preserve clinical operations while narrowing the path a compromised identity can travel. That makes microsegmentation a governance layer for resilience, not a standalone network project.
Identity-based enforcement also changes how security, networking, and clinical teams share responsibility. The important shift is from protecting every device equally to proving that only the communications a device truly needs are permitted.
For practitioners, the strategic question is whether segmentation policy can be tested, explained, and enforced without forcing a re-architecture of the environment. If it cannot, the hospital is still carrying flat-network risk under a different label.
For practitioners
- Define segmentation around clinical identity groups Group devices by function, ownership, and communication need so surgical systems, imaging devices, staff endpoints, and vendor assets do not share the same implicit trust zone.
- Require policy simulation before enforcement Validate what a rule set will block before turning it on, especially for connected medical devices and acquired sites that cannot tolerate disruption.
- Replace VLAN assumptions with containment objectives Treat re-IP, firewall sprawl, and consultant-heavy deployment as warning signs that the segmentation model is too brittle for the hospital environment.
- Separate acquisition onboarding from security vetoes Use identity-based classification and staged enforcement so inherited hospital networks can be absorbed in weeks without reopening flat trust across the estate.
Key takeaways
- The article shows that microsegmentation in hospitals is most valuable when it limits blast radius without interrupting care delivery.
- Its central lesson is that identity-based policy can replace broad network trust with narrower, clinically meaningful communications.
- Teams should judge segmentation by how safely it enables surgery, acquisitions, and ransomware containment, not by how many devices it blocks.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Flat network trust enables attacker movement across hospital devices after initial compromise. |
| Recommendation — Map lateral movement risk to TA0006 and TA0008, then constrain east-west paths to required communications only. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity-based segmentation is an access-authorisation problem applied to devices and services. |
| Recommendation — Apply PR.AA-05 to limit device communications to explicit, justified authorisations. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article’s identity-based model depends on knowing which users, vendors, and devices should be active. |
| Recommendation — Use CIS-5 to keep access inventories current before segmented policy is enforced. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The core control principle is to restrict each device to the minimum communication it needs. |
| Recommendation — Enforce AC-6 by shrinking implicit trust and allowing only required network interactions. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Roughly 1,800 vendors create a third-party access surface that must be governed by identity-aware policy. |
| Recommendation — Inventory and segment third-party device access as governed NHI relationships rather than broad network exceptions. | ||
Key terms
- Identity-based Microsegmentation: A segmentation approach that uses identity, context, and policy to decide whether a connection should be allowed inside a network zone. In OT, it helps reduce lateral movement without relying only on IP addresses or broad subnet rules.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Containment continuity: The ability to limit security impact while keeping essential operations running. In this article’s context, it means a hospital can isolate risk, support clinical workflows, and avoid disruption when segmentation, vendor access, or acquired networks are introduced.
- Identity-aware policy: An authorization model that uses identity context, such as claims, roles, or scopes, to decide what a caller may access. In this pattern, the policy follows the identity at request time instead of relying only on static infrastructure rules, which improves precision but raises governance requirements.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It is designed for practitioners who need to connect identity control to broader security and resilience programmes.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org