Glossary
VLAN (virtual local area network)
Also called: Virtual LAN, network segmentation
In one sentence
A way to split one physical office network into separate, isolated networks so devices in one group can’t freely reach devices in another.
A VLAN lets you divide your office network into separate zones using the same switches, cables and Wi-Fi access points. Your staff computers might be on one VLAN, guest Wi-Fi on another, phones on a third and imaging devices or printers on a fourth. Devices can only cross between zones where your firewall rules allow it.
Why bother? Because flat networks — where everything can talk to everything — let one infected device reach all the others. If a patient on guest Wi-Fi has malware, or a cheap smart TV in the waiting room gets compromised, a VLAN keeps it away from the computers that hold patient records. It also helps performance: phones on their own VLAN can be given priority so calls stay clear.
Segmentation is a recognized security control. It appears in cyber insurance questionnaires and security frameworks, and network segmentation was among the specific requirements in HHS’s proposed update to the HIPAA Security Rule (published January 2025 and, as of this writing, not yet final).
Example: a dental office puts its X-ray sensors and imaging workstations on one VLAN, front-desk PCs on another, VoIP phones on a third and patient Wi-Fi on a fourth that can only reach the internet. A guest’s infected phone can’t even see the imaging server. Our small office network guide and dental imaging guide go deeper.
Related terms
- FirewallA device or piece of software that controls what network traffic is allowed in and out, blocking connections that don’t match its rules.
- Zero trustZero trust is a security approach that never assumes a user or device is safe just because it's inside the office network — every access request is verified based on identity, device health and context.
- Least privilegeLeast privilege means giving every person, account and program only the access it needs to do its job — nothing more, and for no longer than necessary.
- VoIP (voice over internet protocol)Phone service that carries calls over your internet connection instead of traditional copper phone lines.
- SD-WAN (software-defined wide area network)Technology that manages several internet connections together, sending traffic over the best one and switching automatically when one fails or slows down.