Dental Clinic Wi-Fi Security: is your Wi-Fi really separate?

Two Wi-Fi names does not mean two networks

Many clinics have a staff Wi-Fi and a guest Wi-Fi. In a lot of them, both names lead into the same network as the server and patient files.

Does a guest Wi-Fi network keep patients out?

Often it doesn’t. A home style router can show two Wi-Fi names, but behind both names there is often one shared network. A patient on the guest Wi-Fi can then sit on the same network as the front desk PC, the x-ray sensors and the server with your patient files.

Left, what you see: a home style router sends out two Wi-Fi names, Clinic and Guest, but a guest phone, the front desk PC, an x-ray sensor and the server all share one network, so a guest can reach patient files. Right, what we set up: a business firewall and managed switches keep Guest, Staff and Devices in separate walled zones, and the guest is blocked from patient files.WHAT YOU SEEHome style routerOne network insideClinicGuestOne shared networkGuest phoneFront desk PCX-ray sensorServerPatient filesA guest can reach your patient filesWHAT WE SET UPBusiness firewallGuards the doorManaged switchesKeep zones apartGuestGuest phoneInternet onlyStaffFront deskServerPatient filesDevicesX-ray sensorBlocked. Guests get internet only.
Two Wi-Fi names on one network is like two front doors into the same room.

Why does a shared network matter for a clinic?

A shared network puts patient records, imaging devices and guest phones side by side. That makes privacy hard to show to an insurer, lets ransomware spread from one infected phone to the server, and leaves rarely updated devices like sensors and printers exposed. Separate networks keep each problem in its own room.

  • Patient privacy. Patient records should only be reachable by your team. A shared network makes that hard to show your insurer or a privacy review.
  • Ransomware spreads. If one phone or laptop is infected, a flat network lets it reach every other computer, the sensors and the server.
  • Devices are easy targets. Imaging equipment and printers are rarely updated. They should not sit next to guest phones.

What we set up in every clinic we look after

  • Walled off networks (VLANs). Think of separate rooms with locked doors. Staff, guests and devices each get their own network.
  • Managed switches. The boxes your network cables plug into. Ours keep each room apart and can be watched and updated.
  • A business firewall. Not a home router. It guards the door to the internet and the doors between rooms.
  • Guest Wi-Fi gets internet only. Patients can browse while they wait, and that is all.

Not sure how your clinic is set up?

We check this during an IT review at clinics in Vancouver, Edmonton and Calgary. You will get a plain answer: separate or shared, and what it would take to fix. The fix is usually a business firewall, managed switches and VLANs, so each kind of device gets its own network.

Clinic Wi-Fi questions

Is a separate Wi-Fi name the same as a separate network?

No. A Wi-Fi name only changes what shows on a phone. To keep guests away from clinic computers, the network behind the name has to be separate too, with a business firewall and VLANs.

What is a VLAN?

A VLAN is a walled off network on the same equipment. Think of separate rooms with locked doors. Staff, guests and devices each get their own, and the firewall decides what may pass between them.

Should patients get Wi-Fi at all?

Yes, if it is internet only. Patients can browse while they wait, and that is all. The guest network should never reach the front desk, the sensors or the server.

Can you check our clinic Wi-Fi?

Yes. We check it during an IT review and tell you in plain words whether your networks are separate or shared, and what it would take to fix.

Find out if your Wi-Fi is really separate

Call (604) 813-7881, our one line for Vancouver, Edmonton and Calgary. Hours are Monday to Friday, 7am to 5pm MT, and for emergencies the same number is answered by a person 24/7. No pressure, no jargon.

Prefer email? Write to hello <at> bensonhunt <dot> com.