What UniFi equipment do we recommend?
Switching and PoE
Layer 3 PoE switches such as the Pro Max 24 PoE (400W PoE) carry clinical, imaging and guest VLANs on one set of wiring and power access points, phones and readers.
Cloud Gateways
The gateway's zone-based firewall enforces which zones may talk, runs IDS/IPS and keeps patient WiFi isolated by default.
WiFi Access Points
WiFi 7 access points serve staff tablets on a clinical network and patients on a separate guest network from the same hardware.
Access Control
UniFi Access readers and hubs lock records rooms, server closets and drug storage, with entry by card, phone, face or PIN.
Protect Cameras
Protect cameras cover entrances and restricted doors, recorded on site with no per-camera license.
What does HIPAA require of a medical office network?
The HIPAA Security Rule requires covered entities and business associates to put administrative, physical and technical safeguards in place to protect electronic protected health information (ePHI). It does not name a network brand; it expects safeguards that are reasonable and appropriate for the practice.
Source: HHS, Summary of the HIPAA Security Rule. In December 2024 HHS also issued a notice of proposed rulemaking that would, among other changes, require network segmentation (HHS NPRM fact sheet). Whether or not that proposal is finalized as written, segmentation is already a sound way to limit how far an incident can spread.
No network product and no IT provider makes a practice HIPAA compliant. Compliance is a program the practice owns: risk analysis, policies, training, vendor agreements and documentation. Network controls are one set of tools that support it.
Key takeaway: Network segmentation and access control support HIPAA safeguards. They are not, on their own, HIPAA compliance.
How should a clinic separate guest, clinical and imaging devices?
Give each group its own VLAN and firewall zone. UniFi gateways group networks into LAN, WAN, Guest and IoT zones and apply policy between them, so patient phones, front-desk PCs, imaging equipment and building devices never share a flat network.
| Zone | Devices | Allowed to reach |
|---|---|---|
| Clinical | Front desk, exam room and provider PCs, staff tablets | Practice management and EHR systems, printers, internet |
| Imaging | X-ray sensors, imaging workstations, modalities | Imaging server only; vendor remote support by approved path |
| Voice and building | IP phones, door readers, cameras, NVR | Their own controllers; no access to clinical PCs |
| Guest | Patient and visitor phones | Internet only; isolated by default on UniFi gateways |
Source: Ubiquiti Cloud Gateways. Imaging devices (digital X-ray sensors, panoramic units, ultrasound) often run older operating systems the practice cannot patch, which is exactly why they belong in a zone that only reaches the imaging server.
Can door access and cameras protect records and equipment rooms?
Yes, and they address the Security Rule's physical safeguards. A UniFi G3 Reader Pro supports NFC cards, Apple and Google Wallet, face, PIN and QR entry, and a single Door Hub controls one door for up to 6,000 users.
Specs from Ubiquiti's G3 Reader Pro and Door Hub pages. Door users are managed in the same UniFi console as the network, so removing a departing employee's access is part of offboarding rather than a separate system. Protect cameras on the same console record entrances with no per-camera license (Ubiquiti physical security).
PDC administers the camera and door systems: setup, updates, user access and retention settings. PDC does not provide live video monitoring or alarm response.
What UniFi hardware fits a typical medical or dental office?
Most single-location practices need one Cloud Gateway, one or two PoE switches, a few WiFi 7 access points and door hardware for restricted rooms. The Pro Max 24 PoE switch provides a 400W PoE budget, enough for access points, phones, readers and cameras in a typical office.
Specs from the Pro Max 24 PoE, Cloud Gateway Fiber and U7 Pro pages. Practices with several locations can standardize on the same kit per site; see multi-site networks.
- Gateway: Cloud Gateway Fiber (50+ devices / 500+ clients) for most offices.
- Switching: Pro Max 24 PoE, Layer 3, 10G SFP+ uplinks.
- WiFi: U7 Pro access points for exam rooms, hallways and waiting room.
- Door access: G3 Reader Pro and Door Hub on records rooms and server closets.
- Cameras: Protect cameras at entrances, recorded to a local NVR.
How does PDC deliver and support a clinic network?
PDC assesses the current network, designs zones around your devices and workflows, installs after hours to avoid patient disruption, and monitors the network 24/7. We are a High Point company with 39 years in business and provide on-site service within 200 miles.
- Assessment of devices, imaging vendors and current firewall rules.
- Zone and firewall design documented for your risk analysis.
- After-hours installation and cutover.
- Monitoring, firmware updates and help desk through managed IT, with cybersecurity services and backup available.
- Because an IT provider that can access systems holding ePHI is generally a business associate under HIPAA, discuss the business associate agreement before work begins.
- Member of the UniFi Partner Program.
What drives the cost of a medical office network?
The number of rooms, imaging devices and restricted doors drives hardware; cabling in an occupied suite and after-hours work drive labor. UniFi keeps recurring cost low because gateways, switches, access points, cameras and door readers need no per-device license; Apple Wallet passes beyond Ubiquiti's included allotment are the main paid per-user credential item.
See the installation cost guide or call (336) 886-3282 for a network review.
- Exam rooms, operatories and waiting room size.
- Imaging devices and vendor remote-support requirements.
- Doors needing readers, and lock hardware at each door.
- After-hours installation to avoid patient disruption.
- Warranty: one year on hardware from distribution, two years direct (Ubiquiti warranty).
Frequently asked questions
Is UniFi HIPAA compliant?
No network product is HIPAA compliant on its own. The Security Rule requires administrative, physical and technical safeguards that the practice implements and documents. UniFi provides tools such as segmentation, firewalls, door access and cameras that support those safeguards.
Should patient WiFi be on a separate network?
Yes. Patient and visitor devices should reach the internet only. UniFi gateways isolate guest WiFi in its own firewall zone by default, and we keep clinical and imaging devices in their own zones too.
Why put imaging devices on their own network?
Imaging equipment often runs operating systems that cannot be patched on the practice's schedule. A separate zone that only reaches the imaging server limits the damage if one is compromised.
Does HIPAA require network segmentation?
HHS proposed in December 2024 to require network segmentation as part of a Security Rule update. Check the current status with your compliance advisor; segmentation is a sound safeguard either way.
How do staff unlock a records room with UniFi Access?
A G3 Reader Pro accepts NFC cards and fobs, Apple and Google Wallet, face unlock, PIN and QR codes. The practice decides which methods each door requires, and PDC sets up users and schedules during installation.
Does PDC monitor clinic cameras?
No. PDC administers UniFi Protect (setup, updates, user access and retention settings) and monitors the network, but does not provide live video monitoring or alarm response.
Sources
- HHS, Summary of the HIPAA Security Rule
- HHS, HIPAA Security Rule NPRM fact sheet
- Ubiquiti, UniFi Cloud Gateways
- Ubiquiti, physical security
- Ubiquiti tech specs, G3 Reader Pro
- Ubiquiti tech specs, Door Hub
- Ubiquiti tech specs, Pro Max 24 PoE
- Ubiquiti tech specs, Cloud Gateway Fiber
- Ubiquiti tech specs, U7 Pro
- Ubiquiti warranty