How should VLANs be set up in a dental office?

Key facts

Why use VLANs in a dental office?

A flat network lets anything talk to anything. If a front-desk PC opens a malicious attachment, the ransomware can reach the imaging server, the cameras and the backups. CISA's ransomware guide says network segmentation can help contain an intrusion and prevent or limit lateral movement by attackers (CISA). HHS's cybersecurity practices for small healthcare organizations recommend configuring networks to restrict access between devices, so an attack can't spread across the network (HHS 405(d) HICP).

HIPAA itself doesn't name VLANs. HHS describes the Security Rule as flexible, scalable and technology neutral, leaving practices to choose reasonable and appropriate measures for their size and risks (HHS). Segmentation is one way to support the rule's access-control and transmission-security standards (45 CFR 164.312).

What VLANs does a dental office need?

Here is an example plan. The numbers and subnets are illustrative; your IT provider sets the real ones. It matches the logical example in our network diagram examples.

Small offices sometimes merge clinical and imaging. Keep guest, cameras and management separate in every design.

How should imaging be segmented?

Carefully, because imaging software is sensitive to blocked ports. Dentsply Sirona's site survey lists ports that must be open, including SQL Server 1433 and several Sidexis services, and recommends reserved static IPs outside DHCP for the x-ray unit and RCU (Dentsply Sirona). If imaging lives on its own VLAN, the firewall rules must allow those ports between imaging and the workstations that view images. Some units skip the LAN entirely: Carestream's CS 8100 3D must connect to its computer through a point-to-point Ethernet link (Carestream Dental). Get the imaging vendor's survey before writing rules. See network requirements for imaging.

Why do phones get their own VLAN?

For call quality and separation. Cisco's switch guide explains that a voice VLAN lets an access port carry IP phone traffic on one VLAN and data from a PC plugged into the phone on another, and that because call quality can deteriorate when data is sent unevenly, the switch prioritizes voice with quality of service (Cisco). That lets a front-desk PC share a drop with a phone. Ask your phone provider which VLAN tagging their handsets support. See dental office phone systems.

Where do cameras and other IoT devices go?

In a restricted zone. HHS recommends placing high-impact assets, including medical devices and IoT items such as security cameras, badge readers, temperature sensors and building management systems, in more restricted network zones (HHS 405(d) HICP). Cameras should reach the NVR, and staff should reach the NVR's viewer, not the cameras directly. See dental office security cameras.

How should guest Wi-Fi be set up?

On its own VLAN with internet-only access. HHS recommends guest networks in waiting areas that separate organizational data and systems and allow only authorized guest services (HHS 405(d) HICP). NIST's wireless guidance says guest and internal WLANs should be logically separated so devices on one can't connect to devices on the other (NIST SP 800-153). See HIPAA-compliant Wi-Fi and dental office Wi-Fi.

How should vendors and the IT company connect?

Through a controlled path, onto only the segment they support. HHS recommends allowing third parties, including vendors, access only to networks necessary to their role and only through tightly controlled interfaces (HHS 405(d) HICP). The imaging vendor's remote support shouldn't land on the camera VLAN.

The management VLAN holds the keys to everything, so the practice should own those admin accounts, not the IT company. The free credential ownership checklist (coming soon) is planned to list every admin account (firewall, switches, Wi-Fi controller, NVR).

When should the VLAN plan be made?

Before the switch is ordered and before drops are labeled, so the low-voltage contractor knows which jacks are phones, cameras or imaging. The free network & IT plan generator (coming soon) is planned to turn your floor plan into a drops, rack, Wi-Fi and VLAN plan. FloorStack Studio (live, free plan) places every device in a 3D plan so each drop can be assigned a segment.

How FloorStack helps

FloorStack is a dental build-out platform that plans the network, including segments, before the walls close. FloorStack Studio (live, free plan) maps every device. The network & IT plan generator and credential ownership checklist are free tools coming soon. Back to the Dental Office IT Setup hub.

Free tools for this step

• Network & IT plan generator (free tool, coming soon): turn your floor plan into a drops, rack, Wi-Fi and VLAN plan.
• FloorStack Studio (live, free plan): a 3D IT plan of your office with every device placed.
• Credential ownership checklist (free tool, coming soon): list every admin account the practice should own, with a "password hostage" letter template.