Guardra.ai
Hospitals and health systems · nothing else

Your segmentation policy says that VLAN is isolated.
Can you prove it?

Most hospitals assert segmentation and evidence it with a diagram. The diagram is intent. I check it against your own flow records for one boundary and report where the two disagree — with the records, and with what the records cannot show.

No sensor · No agent · No packet capture · No access to your network

See what the assessment covers Talk it through first

One boundary

Config and flow records for a single firewall or HA pair

Metadata only

Addresses, ports, volume, timing — no payload, no packet capture

10 working days

From acceptance of a sample, so we both know the data works

Where we actually are

Guardra is one person and there is no product to buy. What exists is a paid manual assessment of a single enforcement boundary, done by hand. It has never been sold to anyone, so there are no references and no case studies to show you. When there is software, or a customer, this page will say so.

What comes back

Seven things we look for — and what each one cannot tell you.

Everything here is derived from flow metadata and firewall configuration — addresses, ports, direction, volume, timing. No packet capture, no payload, no protocol semantics. The limits are printed alongside the findings because you will hit them in the report anyway.

SEG-01

Segmentation that does not hold

“Your matrix says these zones do not communicate. Do they?”

Flows between zones your own matrix declares separated. In practice this is a rule left from a go-live nobody will touch, a management network that reaches everything because it had to during a migration, or a temporary path from an outage that was never reverted.

Evidence — The intent quoted from your matrix, against the specific flow records that contradict it.

Cannot establish — Observing flows proves a path is open. Observing none proves nothing — the path may be unused, or the collection point may not sit where you think it does.

Maps to

  • HIPAA Security Rule NPRM — proposed segmentation specification
  • HPH CPG — Network Segmentation (enhanced)
SEG-02

Device networks reachable from general IT

“Can a general-purpose subnet reach the biomedical device range?”

Flows between corporate address space and the ranges clinical engineering identifies as biomed. The interesting direction is usually inbound — a workstation that can reach the drug-library server, or a corporate subnet with a path to a modality.

Evidence — Source and destination address ranges, ports, direction and volume across the boundary you define.

Cannot establish — Flow records identify addresses, not devices. We cannot tell you a given host is an infusion pump — only that something in the range you nominated is reachable from somewhere it should not be.

Maps to

  • HIPAA Security Rule NPRM — proposed segmentation specification
INV-01

Addresses absent from your inventory

“What is talking on this network that is not on your list?”

Active addresses in the flow records that are absent from your CMDB or biomed inventory. Routinely: modality workstations, a vendor jump host, research equipment a department bought on a grant, and whatever facilities connected last quarter.

Evidence — Observed active addresses, diffed against the inventory you provide.

Cannot establish — This produces addresses and traffic patterns, not asset identification. Confirming what each one is remains your work — but knowing where to look is the expensive part.

Maps to

  • HIPAA Security Rule NPRM — proposed technology asset inventory
  • HPH CPG — Asset Inventory (enhanced)
EXP-01

Management planes reachable

“Which segments can reach the equipment that enforces your segmentation?”

Flows to management ports on firewalls, switches and infrastructure from segments that should not reach them. CISA has repeatedly flagged edge-device management exposure as an initial access route.

Evidence — Observed connections to management services, and the source segments they came from.

Cannot establish — Reachability observed in the collection window. A management path that saw no traffic in seven days is not shown to be closed.

Maps to

  • HIPAA Security Rule — access control
  • HPH CPG — Network Segmentation (enhanced)
RUL-01

Rules with no observed traffic

“How much of this policy is doing anything?”

Rules that matched nothing during the observation window, plus rules shadowed by broader rules above them. Shadowed rules are a static property of the configuration and can be stated with certainty; unused rules cannot.

Evidence — Rule-by-rule analysis of the configuration, against hits observed in the window.

Cannot establish — Seven days of no hits does not mean a rule is dead. Quarter-end, failover and annual processes all fall outside the window. These are candidates for review, never a delete list.

Maps to

  • HPH CPG — Network Segmentation (enhanced)
VND-01

Vendor paths into the device estate

“Which of your device vendors has a live route in right now?”

Standing remote access for imaging, lab and biomedical vendors — jump hosts, support tooling, and the site-to-site tunnel someone stood up for a go-live in 2021. Clinical engineering usually owns the relationship; the network team inherits the path.

Evidence — Flows to and from the vendor endpoints and maintenance windows you supply, and which internal segments they reach.

Cannot establish — This requires your vendor list — flow records show an external destination, not which support product it is. It shows a path carried traffic, never what was done over it, and a path dormant in the window is not a closed one.

Maps to

  • HIPAA Security Rule — access control
CFG-01

Configuration that contradicts itself

“Does the policy say what its author thought it said?”

Overlapping and redundant rules, objects permitting more than their name suggests, any-any rules surviving from a migration, and rules whose stated purpose no longer matches their effect.

Evidence — Static analysis of the configuration alone — no traffic required, so no window limitation applies.

Cannot establish — This says what the policy permits, not what has happened. A permissive rule with no traffic is still a permissive rule.

Maps to

  • HPH CPG — Network Segmentation (enhanced)
  • HIPAA Security Rule — access control

The assessment

One boundary. Metadata only. Ten working days from acceptance.

Scoped to a single enforcement boundary, because that is what one person can do properly in ten days. No appliance, no SPAN port, no clinical-engineering change request, and no route into your network.

What you send

  • 1Configuration for one enforcement boundaryOne firewall or HA pair — not the estate. Panorama / FMC / FortiManager export or running-config.
  • 2Traffic records for the same boundaryFirewall logs, NetFlow / IPFIX or SIEM export. Metadata only — addresses, ports, direction, volume, timing.
  • 3Your intended segmentation matrixWhich zones may talk to which. A diagram, a spreadsheet, or a photo of the whiteboard.
  • 4Your asset inventory, if one existsOptional. Without it the inventory finding is skipped rather than guessed at.

If the third one doesn’t exist in written form, say so before paying me anything. What you compare against today is a more interesting conversation than the assessment, and without it I would be inventing your intent and then checking it against itself.

What comes back

Findings, each carrying the intent it contradicts quoted from your material, the evidence cited to specific records, and what it cannot establish. Plus a coverage statement: which paths the data could not show me, and why.

Written report, ten working days from acceptance of the sample.

No minimum finding count is promised. If your boundary is clean, the report says so and the coverage statement is the deliverable.

What it is not

  • A scan, a probe, or a penetration test
  • Anything installed on your network
  • Anything touching a medical device
  • Packet capture, payload, or protocol-level analysis
  • A compliance certification, or evidence that stands alone in an audit
  • A product trial — there is no software to buy afterwards

£5,000 / $6,000

One enforcement boundary. Before anything is invoiced, you send a small sample and I confirm the data actually supports the deliverable — if it does not, we stop there and you owe nothing. The clock starts when you accept the sample.

NDA before any file moves. Where you prefer, the analysis runs inside your own VDI and nothing leaves your environment at all. If PHI could be involved, a BAA is required, not optional.

Start a conversation

Reading the estate

The map is never the territory here.

A clinical network is not a corporate one with medical devices bolted on. The things that make it different are also the things that make a segmentation matrix go stale — so it is worth being specific about what gets looked at.

Where to look, and what a port does not prove

A port is a convention, not an identity. A listener on 2575 is a strong hint that something is speaking HL7 and no more than that — flow records carry no payload, so confirming it is yours. What this table is for is knowing where to look and what to ask you about.

PortProtocolWhy it matters
2575HL7 v2 / MLLP by conventionThe conventional port. A listener here is a strong hint, never a proof — you confirm what it is.
5000–6999Interface channels, typicallyNot a standard. Most estates allocate high ports per channel, so your real interface map is dozens of them and only you have the list.
104 · 11112DICOM by convention104 is the well-known port, 11112 the registered alternative. Which hosts use them is yours to confirm.
3389 · 5900 · 22Remote desktop / shellHow workstations get administered. Interesting when the source segment is one that should not be administering anything.
445 · 139SMBFile-based study transfer, downtime report drops, and the usual lateral movement path.
161 · 162SNMPDevice management traffic. We see that it happened and between which addresses — never its contents.
443 outbound to external hostsEgress, unattributedVendor support tooling usually looks like this. Flow records cannot tell you which product it is; the destination and your own vendor list can.

The interface engine is the hardest host to reason about. Whichever one you run — Mirth, Rhapsody, Cloverleaf, Corepoint, Iguana, InterSystems — it sits in the middle and talks to nearly everything by design. In flow records it looks like the worst segmentation violation in the estate and usually is not one. Telling those two cases apart needs your channel list, not cleverness.

Worth asking about before we start

These are routinely on the clinical network and absent from the matrix. We cannot identify any of them from flow records — the assessment reports an unexplained address and you tell us what it is. Half of these come up in the scoping call rather than the report.

  • Nurse call

    Frequently on its own VLAN, frequently reachable from more than it should be.

  • RTLS

    Badge and asset tracking. Talks to almost everything by design.

  • Pneumatic tube

    A networked control system nobody thinks of as networked.

  • Building management

    HVAC and chillers, often with a vendor tunnel older than the current network team.

  • Physical security

    Access control and camera VLANs, routinely trunked into clinical space.

  • Telemetry (WMTS)

    Patient monitoring with its own spectrum and its own gateway into the estate.

  • Digital signage & wayfinding

    Bought by facilities, connected by whoever was free that week.

  • Infusion pump servers

    The drug library server is the interesting host, not the pump.

The recurring theme is ownership. Clinical engineering owns the device, IT owns the network, facilities owns the tube system and the chillers, and the vendor owns the software. Segmentation lives in the gaps between those four, which is why it drifts without anyone doing anything wrong — and why the analysis is only as good as the zone, vendor and asset mappings you supply.

Compliance

What is actually required, and what is only proposed.

A lot of healthcare security marketing blurs these together. We label every regime explicitly, because you will be the one holding the answer in an audit.

HIPAA Security Rule

HHS Office for Civil Rights

In force

Requires administrative, physical and technical safeguards over electronic protected health information, including access control, transmission security and audit controls. Network segmentation is not named in the current rule.

Findings evidence access-control posture. They do not by themselves demonstrate compliance, and nothing here should be presented to an auditor as if they did.

HIPAA Security Rule — proposed update

HHS OCR · NPRM published 6 Jan 2025

Proposed — not final

Would remove the addressable/required distinction and introduce network segmentation as an explicit implementation specification — a new requirement rather than the promotion of an existing addressable one. Also proposes a technology asset inventory and network map, multi-factor authentication on ePHI access subject to stated exceptions, and encryption at rest and in transit. Comment period closed 7 March 2025. As of September 2026 there is no final rule and no compliance deadline; it may change or be withdrawn.

The reason this work is worth doing now. An assessment surfaces contradictions between stated intent and observed traffic — useful preparation, not a compliance artefact.

HPH Cybersecurity Performance Goals

HHS

Voluntary

Voluntary goals split into essential and enhanced tiers. Network segmentation and asset inventory both sit in the enhanced tier. HHS has stated an intention to inform future enforceable standards with the CPGs.

Findings are mapped to the specific enhanced goal they inform.

The proposed Security Rule update is why this work is worth doing now. It has not been finalised, there is no deadline, and it may change or be withdrawn. An assessment surfaces contradictions between what your policy says and what your records show — that is useful preparation, and it is not a compliance artefact. Nobody should present it to an auditor as one.

Why hospitals

Where isolation is the control doing the work.

Not because hospital networks are more interesting than anyone else’s. Because of what happens when the equipment on them cannot be patched on your schedule.

Isolation carries more weight here than anywhere else

A CT scanner is a fifteen-year asset running vendor-controlled software you cannot patch without voiding support. Clinical engineering schedules the downtime, the vendor ships the update, and the window is measured in quarters. Where patching moves at that pace, network position ends up carrying the load — and it is the control verified least often.

The proposed rule names segmentation specifically

Most sectors have no regulator proposing segmentation as an explicit requirement. Healthcare does, in the January 2025 NPRM. That is not yet law, but it means the question is already on the agenda of the person who would buy this.

Hospitals will take the call

A network manager at a community hospital or regional system will take the call. The same role inside a global bank will not, and for work that depends on a real conversation before anything gets built, reachability beats market size.

Enforcement

Where intent is written down and where it stops being true.

Palo AltoCisco FMC / ASAFortinetCheck PointCore switching ACLsNAC posture

Records

What we read. Metadata only — addresses, ports, direction, volume, timing.

Firewall traffic logsNetFlow / IPFIXSIEM exportRule hit counters

Context you supply

Nothing here is inferred. Without it, findings degrade to unexplained addresses.

Zone-to-range mappingApproved vendor endpointsMaintenance windowsAsset inventory (optional)

Zones you define

You name the ranges — we do not infer them. Most estates have more than the matrix lists.

Clinical / EHRBiomedImaging / PACSLabPharmacyCorporateGuestVendor accessManagementResearch

There is a longer argument about clinical protocols being readable on the wire, which would let an assessment say what a flow is rather than merely that it exists. That needs packet capture, which needs a BAA and a clinical-engineering conversation. It is not what is being offered here, so it is not being claimed here.

Where our claims come from

Every claim traces to a source you can check.

Hospital security teams verify things for a living. So every regulatory status on this site links to the primary document rather than to someone’s summary of it — including the ones that say a rule is only proposed.

HHS Office for Civil RightsHIPAA Security Rule · breach portalFederal RegisterSecurity Rule NPRM, 6 Jan 2025HHS 405(d) / HPH CPGsEssential & enhanced performance goalsHL7 Internationalv2.x messaging · MLLP transportDICOM StandardDIMSE services · DICOMwebFDA§524B cyber device requirementsCISAHealthcare sector advisories · KEV catalogSAMHSA42 CFR Part 2NISTSP 800-66r2 · HIPAA Security Rule guidance

FAQ

The awkward questions first.

No software. Guardra is one person, and what exists today is a paid manual assessment — I read your firewall configuration, your traffic records and your segmentation matrix by hand, and write the findings myself. There is nothing to install, nothing to trial, and nothing to buy at the end of it. If that changes, this page will change with it.

You should not, until a sample proves the data supports the deliverable — which is why nothing is invoiced before that step. The fee reflects a bounded scope of one enforcement boundary rather than an estate-wide review, and the fact that what I learn from the engagement is worth as much to me as the money.

Those are platforms — sensors, device fingerprint libraries, continuous monitoring, and a decade of data I cannot replicate. They also do clinical asset discovery and segmentation policy generation, which I do not. If you run one, the honest question is what it does not tell you, and if there is no answer you should not hire me. What I do is narrower and vendor-neutral: a one-off check of your written intent against your own records for one boundary, with nothing to adopt afterwards.

They do firewall policy analysis properly and at scale, and Palo Alto ships a version of it inside the firewall itself. If you already run one, I am probably redundant and you should say so. The narrower thing I offer is independence and a specific question — your written segmentation intent, checked against your own records for one boundary, by someone with no product to sell you afterwards. Whether that is worth anything to you is a fair thing to be sceptical about.

No. Everything is done from exports you generate, or inside your own VDI if you prefer nothing leaves at all. I never connect to anything, never probe, never scan, and never touch a device. That removes the clinical-engineering approval and the change window. It does not remove the risk conversation — a firewall configuration exposes your topology and sometimes more, and your third-party risk team is right to treat it that way.

The engagement is scoped to metadata — addresses, ports, times, volumes — and structured so PHI is not required. Worth being precise though: HHS de-identification guidance lists IP addresses and device identifiers among its identifiers, so the absence of packet payload does not by itself settle whether an export contains PHI. That depends on content and context, which is why we agree the export schema before anything moves. If your export could contain payload or identifiers, say so and we scope it out or run the analysis inside your environment. If PHI is genuinely in scope, a BAA is required before anything moves; that is not a preference, it is the arrangement HHS expects.

Not today. The HIPAA Security Rule NPRM published on 6 January 2025 would remove the addressable/required distinction and introduce network segmentation as an explicit implementation specification — a new requirement, not the promotion of an existing addressable one. It also proposes a technology asset inventory and network map. The comment period closed in March 2025. As of September 2026 there is no final rule and no compliance deadline, and it could still change or be withdrawn. Under the voluntary HPH Cybersecurity Performance Goals, segmentation and asset inventory both sit in the enhanced tier.

Say so before paying me anything. Whatever you compare against today is the more useful conversation, and if the answer is that nothing is written down, the assessment would mostly be me inventing your intent and then checking it. That is not worth your money.

They are yours. Nothing is published, reused or referenced without written permission, and I will sign your NDA before you send a single file. If the report turns out to be thin, I would rather you say so publicly than pretend otherwise.

Because isolation carries more weight in a clinical estate than almost anywhere else — long equipment lifecycles, vendor-controlled software and maintenance windows measured in quarters mean network position ends up doing work that patching does elsewhere. Healthcare is also the one sector whose regulator has proposed naming segmentation explicitly. Cleartext clinical protocols would make a deeper analysis possible, but that needs packet capture and a BAA, and it is not what this offer does.

Send three files. Find out what your policy is missing.

A firewall config export, seven days of logs you already keep, and whatever you use as a segmentation matrix. Nothing gets installed and nothing touches a device.

Start a conversation Read the detail first

NDA before you send anything · findings are yours