Web filtering for healthcare guest networks
Patients and visitors now expect Wi-Fi in every hospital, clinic, care home and waiting room. For long-stay patients it is a lifeline to family, entertainment and work.
The same network is shared by children, people in crisis and the public, and it sits a few switches away from clinical systems. This guide covers how healthcare IT teams and their providers filter patient and visitor Wi-Fi so it is safe without getting in the way of care. For clinical and staff networks, see our healthcare web filtering overview.
Who uses a healthcare guest network
A hospital guest network carries far more kinds of users than a hotel or office. Knowing who they are is the first step to a fair policy.
Long-stay patients
Weeks or months on a ward. They stream, video call family, manage bills and sometimes work. Their tablet is effectively their home connection.
Children and teens
Paediatric patients and young visitors on their own phones and game consoles, often unsupervised for long stretches.
Visitors and carers
Family members waiting for hours in corridors, cafes and relatives' rooms, sometimes overnight.
Vulnerable adults
People in mental health crisis, with dementia or with learning disabilities, where safety plans may limit some content.
Staff personal devices
Staff often join the guest network on their own phones during breaks. That is separate from clinical access and should stay so.
Contractors and students
Engineers, agency workers and trainees who need internet but must not reach clinical systems.
Risks and goals on patient and visitor Wi-Fi
Write these down with your information governance, safeguarding and patient experience leads. They decide how strict each area should be.
Risks to manage
- Explicit content in shared spaces. Bays with curtains, open waiting rooms and children nearby make this a frequent complaint.
- Malware on a network next to clinical systems. Even with segmentation, infected devices raise the risk to everything nearby.
- Phishing against patients. Fake hospital payment and parking sites target people who are stressed and distracted.
- Harmful content for vulnerable patients. Some patients have care plans that restrict access to drugs, weapons or violent material.
- Bandwidth exhaustion. Hundreds of streams in the evening can slow the guest network to a crawl.
- Misuse and abuse. A public network can be used for illegal activity, which reflects on the organisation.
Goals to aim for
- Health information always reachable. Patients research their condition, treatment and support groups.
- A home-like experience for long stays. Streaming, messaging and video calls should just work.
- Strict separation from clinical networks. Guest devices never reach EHR, imaging or medical devices.
- Stricter rules only where they are needed. Children's wards and secure units, not the whole site.
- Clear, kind messaging. A blocked page should never feel like an accusation.
- Minimal logging. Guest browsing in a hospital can reveal sensitive health information.
Policy profiles by care setting
One guest policy for a whole hospital is either too loose for the children's ward or too strict for the oncology day unit. Split by area and agree each profile with the clinical team that runs it.
Entrances, cafes and outpatients
Block security categories, Adult, Illegal Drugs, Hate/Discrimination and File Sharing/P2P.
Keep everything else open, including VPNs.
Adult inpatient and long-stay wards
The public baseline, but with generous streaming and messaging. Patients may be here for months.
Consider Adult blocking because bays are shared spaces.
Children's wards and play areas
Add Dating, Weapons, Violence, Gambling, Alcohol, Tobacco, Lingerie/Swimsuits/Intimate Apparel and VPN / Proxy / Anonymizers.
Force SafeSearch and restricted video mode.
Mental health and secure units
Set with the care team. Often adds Weapons, Illegal Drugs, Violence and VPN / Proxy / Anonymizers, with exceptions in individual care plans.
Never filter as punishment.
Maternity and neonatal
Public baseline. Parents stay long hours and need messaging, video calls and parenting resources.
Keep Health & Medicine and Community Sites open.
Care homes and hospices
Residents live here. Treat their network like a home connection with security filtering, and agree anything stricter with residents and families.
Shared lounge screens can follow the public baseline.
Category matrix for healthcare guest networks
A starting point using categories from our full web filtering category list. Tune it with your safeguarding and patient experience teams.
| Category | Public areas | Adult wards | Children's ward | Mental health unit | Care home |
|---|---|---|---|---|---|
| Malware / Phishing / Suspicious | Block | Block | Block | Block | Block |
| Adult | Block | Block | Block | Block | Discuss |
| Illegal Drugs | Block | Block | Block | Block | Discuss |
| Hate/Discrimination | Block | Block | Block | Block | Block |
| Weapons, Violence | Optional | Optional | Block | Block | Allow |
| Gambling | Optional | Optional | Block | Block | Discuss |
| VPN / Proxy / Anonymizers | Allow | Allow | Block | Block | Allow |
| File Sharing/P2P | Block | Block | Block | Block | Limit |
| Dating | Allow | Allow | Block | Care plan | Allow |
| Streaming Media, Gaming | Shape | Allow | Allow | Care plan | Allow |
Health information is not adult content
Sexual health, contraception, addiction recovery, eating disorder support and mental health services must stay reachable. Test these explicitly after every policy change, because overblocking them causes real harm.
What category filtering can and cannot do
Be clear with clinical teams about the limits. Website category filtering is one safety layer, not a substitute for observation, care plans or safeguarding processes.
Stop whole categories of sites from loading on a network, on every device, including new domains as soon as they are categorized.
Read messages, watch what is on a screen, judge a patient's state of mind or see content inside apps that reuse one domain for everything.
Monitor individual patients or alert staff about a person. Our data categorizes websites, not people.
Ward rules on device use, staff observation, care plans and your safeguarding process for anything involving risk to a person.
How to deploy filtering on a healthcare guest network
Segmentation comes first, filtering second. The guest network must be isolated from clinical systems by firewall rules before any category policy matters.
Guest SSIDs on their own VLANs, with firewall rules that block any route to clinical, building and medical device networks. Test the separation regularly.
Turn on client isolation so patient devices cannot see each other. This also stops casting to the wrong person's screen.
Use separate SSIDs or location-based VLANs so the children's ward and secure units get their own profile automatically.
Point each guest VLAN at its own DNS filtering profile. Block outbound DNS to anywhere else so devices cannot skip it.
Give Streaming Media a fair share at peak times rather than blocking it, and limit P2P.
A short, friendly line on the login page and a ward contact for review requests.
Hosted DNS filter
Our managed DNS filter gives each area its own profile, schedules and reports, with no software on patient devices. A good fit for clinics, care homes and hospitals without a filtering team.
Hospital firewall
Many trusts already run firewalls with category filtering. Use them to enforce DNS and segmentation. HTTPS inspection is not practical on guest devices because they do not trust your certificate.
Wi-Fi platform feature
Patient Wi-Fi and bedside entertainment providers can build filtering into their own service using licensed category data, so one contract covers access, portal and filtering.
For background on the method, read what DNS filtering is, and for visitor networks in general, our guest Wi-Fi content filtering guide.
Running it day to day
Most problems appear after go-live, when real patients start using the network. Plan the routines before the switch-over.
Review requests
Ward staff need one contact to ask for a site review. Patients should not wait days for a support group site to open.
Care plan exceptions
Individual exceptions belong in the care plan and the clinical team's records, not in ad hoc firewall rules.
Monthly report
Top blocked categories per area, reviewed with safeguarding and patient experience leads.
Change control
Any change to a ward profile is agreed with the ward lead and tested against the always-open list.
Small sites: clinics, practices and pharmacies
Not every healthcare guest network belongs to a hospital. Doctors' practices, dental surgeries, physiotherapy clinics, pharmacies and imaging centres run small waiting room Wi-Fi with no IT team on site.
One router, two networks
The practice network for clinical software and a guest network for the waiting room, often on the same small business router.
Check that the guest network is isolated from the practice network.
DNS filtering on the guest side
Point the guest network's DNS at a filtering profile with the public baseline. It takes minutes and covers every visitor device.
Add Adult and P2P at minimum.
The practice network too
Reception PCs receive the most phishing. Apply security categories and newly registered domain blocking to the practice network as well.
Many small practices skip this.
Hospital-owned tablets and bedside devices
Some wards lend tablets to patients for video calls, entertainment or patient education. These are shared devices, so they need a stricter approach than a patient's own phone.
Managed profile
Enrol loan tablets in device management and apply a filtering profile that follows the device on and off the ward network.
Reset between patients
Clear accounts, browsing data and downloads before a tablet goes to the next patient.
Children's tablets
Lock to the children's profile, SafeSearch and a short list of apps.
Accessibility
Do not block assistive tools, translation services or communication apps that some patients rely on.
Mistakes we see on healthcare guest networks
These are the problems that most often lead to complaints from patients, staff or auditors.
Policy mistakes
- Using a corporate staff policy on patient Wi-Fi, which blocks streaming, social networks and games that long-stay patients rely on.
- Blocking health sites by keyword, so sexual health and addiction pages fail to load.
- One policy for the whole site, too loose for children and too strict for adults.
Network mistakes
- Guest and clinical networks separated by VLAN tag but routed together at the core.
- Patient devices able to use their own DNS server and skip the filter.
- DNS logs with bed numbers kept indefinitely on a shared server.
Privacy: guest browsing can reveal health information
A list of domains looked up from a ward can show a patient's condition, worries and treatment. Treat guest network logs as sensitive data.
Log only what you need
Blocked lookups for security and policy review are usually enough. Avoid keeping full browsing histories.
No per-patient reports
Report by area and category, not by device or name. The filter is not a patient monitoring tool.
Short retention
Set a short retention period, record it in your data protection documents and stick to it.
Portal data
If the login page asks for an email or bed number, explain why, and keep it apart from DNS logs.
Legal and policy pointers
General information, not legal advice. Check current requirements with your compliance, information governance and legal teams.
HIPAA (United States)
The HIPAA Security Rule protects electronic protected health information. It does not tell you which sites to block for patients, but it is the reason guest networks must be separated from systems that hold patient data.
Data protection (UK and EU)
Under GDPR and UK GDPR, logs that can be tied to a patient may reveal health data, which is a special category. Minimise, secure and explain them.
Public sector guidance
Public bodies, including health services, often follow national or regional guidance on filtering illegal and inappropriate content on public Wi-Fi. Check the current guidance that applies to your organisation.
Patient rights and capacity
Restricting an adult patient's access goes beyond a network decision in some settings. Mental health and capacity laws differ by country and state, so involve clinical and legal leads.
Children's settings
Paediatric areas follow the organisation's safeguarding policy. Filtering supports it but does not replace supervision or safeguarding procedures.
Copyright and misuse
Intermediary safe harbours may apply to public Wi-Fi, with conditions. Blocking P2P and keeping basic logs helps you respond to complaints.
For patient Wi-Fi and healthcare IT vendors
Patient entertainment systems, bedside tablets, guest Wi-Fi platforms and healthcare MSPs can offer filtering as part of their service. Category data is the piece most vendors would rather license than build.
See OEM licensing for embedding our data, or MSP web filtering if you manage networks for clinics and care homes.
- 120 million categorized domains in 59 web filtering categories
- IAB Content Taxonomy in the same file for content and entertainment systems
- About 300,000 newly registered domains categorized every day
- Runs on-premise or air-gapped inside your platform, lookup API included
- Regular manual validations measure accuracy
- Starter database tiers from $999; OEM licences quoted per deployment
Healthcare guest network FAQ
Should hospital patient Wi-Fi be filtered?
Most hospitals filter patient and visitor Wi-Fi for security and for illegal and explicit content, because wards and waiting rooms are shared spaces. Health information must stay fully reachable.
Does HIPAA require filtering on guest Wi-Fi?
HIPAA does not list content categories to block on patient Wi-Fi. Its relevance is keeping the guest network separate from clinical systems and protecting devices from malware and phishing.
What should be blocked on a hospital guest network?
A common baseline is Malware / Phishing / Suspicious, Adult, Illegal Drugs, Hate/Discrimination and File Sharing/P2P. Children's wards add more, and mental health units follow a clinical policy.
Will a filter block health information patients need?
It should not. Keep Health & Medicine open on every profile, including sexual health, addiction and mental health resources.
How do we filter different wards differently?
Use separate network names or VLANs per area and map each to its own DNS filtering profile.
Should staff use the guest network on their own phones?
Many hospitals allow it during breaks, and it keeps personal devices off clinical networks. Staff on the guest network follow the guest policy, and clinical access should always go through managed devices and staff networks.
Can a filter tell us which patient visited a site?
It should not be used that way. Good practice is to report by area and category, keep only blocked lookups for a short time, and leave any concern about an individual to the clinical team and safeguarding process.
Does a small clinic need anything complicated?
No. Most small practices only need an isolated guest network on the existing router and a DNS filtering profile with the public baseline. Apply security categories to the practice network as well.
Can patients use VPNs on hospital Wi-Fi?
In general areas most hospitals allow VPNs. On children's wards and secure units, blocking VPN / Proxy / Anonymizers is common so the filter cannot be bypassed easily.
Safer patient Wi-Fi, without blocking care
Tell us about your sites, wards and guest networks, or the patient Wi-Fi product you build. We will suggest the hosted filter or a data licence.
Talk to us