Healthcare
Protect Patient Data Without Slowing Down Care
- 01
Identify sensitive values
- 02
Replace with stable tokens
- 03
Restore only inside your boundary
01
Requirements reviewed with your team
02
Technical fit and integrations assessed
03
Pilot scope defined around measurable outcomes
How access and data actually move in a hospital
A hospital network is not an office network. A nurse badges into a shared workstation on a unit, charts for four minutes, and walks away. A radiologist reads studies from home at 2am through a PACS viewer. A biomed vendor connects to an infusion pump fleet for firmware support. A revenue-cycle contractor in another state works claims in a browser.
Everything on that list has to be fast, and very little of it is a managed laptop with a compliant OS build and an endpoint agent. A meaningful share of it is equipment that cannot run an agent at all and that the manufacturer will not let you patch.
So the historical answer was a flat clinical VLAN plus a VPN, which means the infusion pump fleet and the claims contractor are, at layer 3, neighbors. That adjacency is the property ransomware operators depend on, and it is the thing worth removing first.
Where healthcare is actually exposed
Five failure modes specific to this environment, not a restatement of general security advice.
01
Vendor and biomed remote support
Imaging, infusion, lab, and EHR vendors all need remote paths into devices and servers. What they usually get is a VPN account or a persistent site-to-site tunnel scoped to a subnet rather than to the specific systems they service. Nobody wants to be the person who denies a vendor during a 3am escalation, so the tunnel stays open permanently.
02
Shared clinical workstations
One workstation, a dozen users, badge-tap switching, and a session that keeps running while the physical person changes. Identity at login is not identity during the session. An access decision made once at connection time does not survive a busy unit.
03
PHI in AI workflows
A clinician drafts a referral letter or summarizes a discharge note in a general chatbot. The text carries a name, an MRN, and a diagnosis. HIPAA does not care that the tool was convenient. A vendor with no BAA now holds protected health information, and nothing in the network path looked unusual enough to alert on.
04
Devices you cannot patch or agent
Much connected clinical equipment runs an operating system the manufacturer will not let you update, with no capacity for an endpoint agent and no appetite from clinical engineering for downtime. You cannot harden the device. You can only control what it reaches and what reaches it.
05
Remote reading and after-hours access
Radiology, telehealth, and on-call specialists work from home networks on mixed devices, often at the worst hour of the night. The clinical urgency is real, so any control that adds a visible step gets routed around within a week. If it is slower than the VPN, it will not survive contact with an on-call schedule.
Who this page is for
- CISO / Head of Security
- Owns the ransomware blast-radius question and already knows the flat clinical VLAN is the answer to it.
- Privacy officer / HIPAA compliance
- Has to account for where PHI goes, including into AI tools nobody formally approved.
- Biomed and clinical engineering
- Owns devices that cannot be patched and vendors who need a way in tonight.
- CMIO / clinical informatics
- Will block anything that adds friction to a four-minute charting session, and is right to.
- IT operations
- Runs the VPN and the remote-reading delivery stack, and fields the 2am ticket when either breaks.
How a team would actually run this
Scoping a biomed vendor to the devices they actually service
- 01 Publish the vendor's management console and the specific device endpoints behind MaskFlare Access instead of routing the vendor into the clinical VLAN.
- 02 Bind the policy to the vendor's identity, a support window, and where the contract requires it, an approval step per session.
- 03 Keep the existing tunnel live during the pilot, so a 3am support call never depends on a migration being finished.
- 04 Retire the tunnel once the console is verified. The vendor's reach is now a list of devices you can hand to an auditor.
Remote reading without a VPN client on a home machine
- 01 Publish the PACS viewer as an application rather than a network route.
- 02 Evaluate device posture where the device is managed, and fall back to browser-delivered access where it is not, so a personal machine never joins the network.
- 03 Because authorization is evaluated per request, an idle overnight session does not stay trusted by default.
- 04 Measure the path. If it is slower than the VPN it replaced, clinicians will tell you, and they should.
Drafting with AI without sending PHI to the vendor
- 01 Route approved AI tools through Vault so prompts are inspected before they leave.
- 02 Names, MRNs, dates of birth, and addresses are replaced with stable tokens. The clinical content the model needs to be useful stays intact.
- 03 The draft returns and is re-identified inside your boundary, so the clinician sees a finished letter and the vendor never held the identifiers.
- 04 You keep a record of what was redacted, which is what a privacy officer needs when the question arrives.
Which modules apply, and why
Each links to the module page, where the boundaries and development status are set out in full. Or start at the MaskFlare platform overview.
Zero Trust & SASE
MaskFlare Access
Publishes the EHR, PACS viewer, and vendor consoles as applications, so a compromised endpoint or a vendor tunnel is not adjacent to the device fleet.
Zero Trust & SASE
MaskFlare Vault
Detects and tokenizes PHI before a prompt reaches an AI tool, then restores it inside your boundary.
Zero Trust & SASE
MaskFlare Shield
Inspects internet-bound traffic for staff on the hospital network, at home, or on a clinic's broadband line under one policy.
Zero Trust & SASE
MaskFlare Browser
Delivers access through an isolated browser session for personal and vendor devices that will never run your agent.
Regulatory context
Readiness and relevance, not certification. Nothing here is a claim to hold an audit or authorization we do not have.
- HIPAA Security Rule
- Access control, audit controls, and transmission security are where MaskFlare is relevant. It is a technical safeguard you would cite in a risk analysis, not a compliance product.
- Business associate agreements
- If MaskFlare processes PHI in your deployment, a BAA is part of the conversation. Raise it during pilot scoping rather than after.
- HITRUST / SOC 2
- Roadmap, not achieved. We will not describe MaskFlare as certified or independently audited until it is.
- 42 CFR Part 2 and state law
- Substance use disorder records and state-specific rules can be stricter than HIPAA. Redaction policy should be written against the strictest rule that applies to the data, not the general one.
What MaskFlare does not do
- MaskFlare is pre-launch. Capabilities here are in development, and pilot scope is agreed case by case.
- No HITRUST, SOC 2, or ISO 27001 today. Roadmap only, with current status in the Trust Center.
- MaskFlare does not do medical device inventory and passive OT discovery, EHR integration work, or clinical data de-identification for research release under an expert determination. Those need dedicated tools.
- Redaction reduces exposure. It is not a legal opinion that a workflow is HIPAA compliant, and no vendor can honestly give you that.
Four questions to ask any vendor here
Including us. If our answer is worse than someone else's, you should know that before a pilot, not during one.
- 01Can a vendor be granted access to four specific devices rather than the VLAN they sit on? Ask to see the resulting policy, not the architecture slide.
- 02What happens to an authorized session when the person at a shared workstation changes? If nothing does, identity is being checked once and assumed forever.
- 03Where does PHI re-identification happen after an AI call, inside our boundary or in the vendor's cloud?
- 04How much latency does this add to a PACS study load over a home connection? Ask for a number from a real test, not a network map.
Workflow guides for this industry
How a team applies each of these, including the contrast with the tool it replaces.
Definitions worth agreeing on first
Healthcare questions we get asked
Can clinicians reach the EHR without a VPN client on a personal device?
That is the intended path, delivered through an isolated browser session so the personal device never joins the network and no client install is required. The capability is in development, and which applications it covers first is part of pilot scoping.
How does this reduce ransomware blast radius on a flat clinical network?
By removing the adjacency the attack depends on. When an application is published individually, a compromised workstation can reach the applications that user is authorized for and nothing else on the segment, so lateral scanning finds nothing to move to.
Will PHI redaction break a clinical AI workflow?
It changes what the model sees, so it has to be tested against the actual workflow. Tokens are stable within a session, which preserves the internal consistency a summary needs, but a workflow that genuinely depends on the identifier itself is one to find during a pilot rather than after rollout.
Is MaskFlare HIPAA compliant?
No product is HIPAA compliant on its own, and any vendor claiming otherwise is overstating it. MaskFlare is a technical safeguard you would cite for access control and transmission security. Whether PHI processing requires a BAA depends on your deployment, and that belongs in pilot scoping.
Do you support access for medical devices that cannot run an agent?
The control sits on the access path rather than the device, which is the point. You are not installing anything on an infusion pump. You are deciding what can reach it and from where.
What about vendors who need emergency access outside a support window?
Policies can carry a break-glass path, but the trade-off is real: an always-available exception used often is just a tunnel with extra steps. Decide during scoping who approves it and what gets logged, because that decision determines whether the control holds.
Early customer program
We're looking for healthcare teams with a specific exposure from the list above and a willingness to scope a pilot around one measurable outcome. Bring the constraint that makes it hard, because that is the part worth talking about.
Your next chapter starts here
Make room for possibility.
We'll talk protection.
Tell us what your team needs to protect.
Let's explore where MaskFlare could fit.