Understand clinical cyber risk. Coordinate the response.

“Your matrix says these zones do not communicate. Do they?”

Flows between zones your own matrix declares separated. In practice this is a rule left from a go-live nobody will touch, a management network that reaches everything because it had to during a migration, or a temporary path from an outage that was never reverted.

Evidence — The intent quoted from your matrix, against the specific flow records that contradict it.

Cannot establish — Observing flows proves a path is open. Observing none proves nothing — the path may be unused, or the collection point may not sit where you think it does.

Maps to

• HIPAA Security Rule NPRM — proposed segmentation specification
• HPH CPG — Network Segmentation (enhanced)

“Can a general-purpose subnet reach the biomedical device range?”

Flows between corporate address space and the ranges clinical engineering identifies as biomed. The interesting direction is usually inbound — a workstation that can reach the drug-library server, or a corporate subnet with a path to a modality.

Evidence — Source and destination address ranges, ports, direction and volume across the boundary you define.

Cannot establish — Flow records identify addresses, not devices. We cannot tell you a given host is an infusion pump — only that something in the range you nominated is reachable from somewhere it should not be.

Maps to

• HIPAA Security Rule NPRM — proposed segmentation specification

“What is talking on this network that is not on your list?”

Active addresses in the flow records that are absent from your CMDB or biomed inventory. Routinely: modality workstations, a vendor jump host, research equipment a department bought on a grant, and whatever facilities connected last quarter.

Evidence — Observed active addresses, diffed against the inventory you provide.

Cannot establish — This produces addresses and traffic patterns, not asset identification. Confirming what each one is remains your work — but knowing where to look is the expensive part.

Maps to

• HIPAA Security Rule NPRM — proposed technology asset inventory
• HPH CPG — Asset Inventory (enhanced)

“Which segments can reach the equipment that enforces your segmentation?”

Flows to management ports on firewalls, switches and infrastructure from segments that should not reach them. CISA has repeatedly flagged edge-device management exposure as an initial access route.

Evidence — Observed connections to management services, and the source segments they came from.

Cannot establish — Reachability observed in the collection window. A management path that saw no traffic in seven days is not shown to be closed.

Maps to

• HIPAA Security Rule — access control
• HPH CPG — Network Segmentation (enhanced)

“How much of this policy is doing anything?”

Rules that matched nothing during the observation window, plus rules shadowed by broader rules above them. Shadowed rules are a static property of the configuration and can be stated with certainty; unused rules cannot.

Evidence — Rule-by-rule analysis of the configuration, against hits observed in the window.

Cannot establish — Seven days of no hits does not mean a rule is dead. Quarter-end, failover and annual processes all fall outside the window. These are candidates for review, never a delete list.

Maps to

• HPH CPG — Network Segmentation (enhanced)

“Which of your device vendors has a live route in right now?”

Standing remote access for imaging, lab and biomedical vendors — jump hosts, support tooling, and the site-to-site tunnel someone stood up for a go-live in 2021. Clinical engineering usually owns the relationship; the network team inherits the path.

Evidence — Flows to and from the vendor endpoints and maintenance windows you supply, and which internal segments they reach.

Cannot establish — This requires your vendor list — flow records show an external destination, not which support product it is. It shows a path carried traffic, never what was done over it, and a path dormant in the window is not a closed one.

Maps to

• HIPAA Security Rule — access control

“Does the policy say what its author thought it said?”

Overlapping and redundant rules, objects permitting more than their name suggests, any-any rules surviving from a migration, and rules whose stated purpose no longer matches their effect.

Evidence — Static analysis of the configuration alone — no traffic required, so no window limitation applies.

Cannot establish — This says what the policy permits, not what has happened. A permissive rule with no traffic is still a permissive rule.

Maps to

• HPH CPG — Network Segmentation (enhanced)
• HIPAA Security Rule — access control