Healthcare networks carry EHR traffic, imaging, medical-device telemetry, and clinician-mobility sessions on the same wire. Netcom designs the segmentation that keeps an infusion pump from being two TCP hops away from an attacker-controlled workstation — while keeping Epic, Cerner, and athena under 200ms.
Most medical devices were designed without security as a first-class concern — and many of them can't be patched on your schedule because they're FDA-cleared as-is. The result: a typical clinic carries dozens of device classes that must coexist on the same physical network with clinician workstations, guest Wi-Fi, VoIP phones, and the EHR itself.
The solution isn't "buy a better infusion pump." It's architecture: dynamic VLAN assignment at the switch port, role-based policy at the firewall, and zero east-west trust inside the data center. When an unpatchable device gets compromised, the blast radius is one VLAN — not the whole clinic.
Netcom designs healthcare networks around three anchors. Segmentation by device class (not just by location). Clinician mobility via Zero Trust access (no VPN). And QoS that guarantees EHR and imaging get the pipe they need while guest Wi-Fi is rate-limited and isolated. Cutover always happens in reversible windows — the night before is never more important than the morning clinic.
Sized for a multi-clinic group (3–50 clinics) or a mid-sized hospital campus. Enterprise health systems extend the same pattern to Cisco Catalyst + ISE.
Illustrative customers drawn from real deployment patterns. Names are fictional; scope, vendors, and outcomes reflect actual Netcom work.
Audit cycle flagged flat-network findings across 42 clinics. Netcom designed FortiGate 600F core with Aruba ClearPass profiling every port, new VLAN plan per device class, cutover sequenced around clinic hours. Two surprises during rollout: a vendor-supplied ultrasound cart shipped with a hardcoded IP address that couldn't be DHCP'd, forcing a per-device static reservation rule at eight clinics. One clinic had an undocumented lab-analyzer VLAN that only appeared on the wire at 9pm — caught cutover night when results stopped routing, patched before morning draw. 16-week plan held; zero clinical downtime; some long nights.
New-construction Epic deployment required strict isolation of the operating-room network, imaging (PACS/DICOM), and anesthesia devices. Netcom delivered dedicated Catalyst 9300-48UXM stacks per OR with TrustSec SGTs, a 9500 StackWise Virtual core, and prioritized paths to the radiology array. Had to pivot mid-design: original plan used a shared 100G uplink aggregation to radiology — turned out PACS peak draw during M-Tu-Th morning rounds overwhelmed one side of the LAG. Reconfigured to dual active-active 100G with per-modality flow hashing. Latency hit target on retrofit.
Dental network with 60 locations on a mix of low-bandwidth DSL and cable. Netcom deployed Meraki MX67 + Cradlepoint S700 5G failover, new imaging SSID isolated from guest, remote-worker FortiClient ZTNA for administrative staff. Not every location went smooth: three rural offices had cellular signal too weak for reliable primary, requiring roof-mounted Panorama MIMO antennas with 25-foot LMR-400 runs. One practice owner refused the antenna on aesthetic grounds and ended up accepting a bonded-DSL upgrade instead. 56 of 60 sites live on the uniform standard; four on per-site carve-outs documented in the runbook.
Tell us your clinic count, device inventory (rough), and EHR platform. Within 10 business days you'll get a segmentation plan, a BOM, and a cutover schedule sequenced around clinic hours.