In short
Zero trust in healthcare means every user, device and connection proves itself before reaching clinical or admin systems. For UK clinic groups, dental and GP practices, care providers and labs, that means MFA, per-app ZTNA for staff, locums and suppliers, and segmentation for connected devices. Organisations accessing NHS patient data and systems must also use the DSPT.
Get a quote for zero trust for healthcare
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
Who this page is for
This guide is for the people who run IT in independent healthcare: private clinic and hospital groups, dental and GP practice groups, optometry and physiotherapy chains, care home operators and domiciliary care providers, diagnostic labs, and the software and service suppliers that work for them.
These organisations share a problem. Their systems hold sensitive records, their staff move between sites and shifts, and a long list of outside people need some access: locums, visiting consultants, agency staff, system suppliers and equipment engineers. A flat network and a shared remote access VPN make every one of those people a possible route to everything.
Zero trust replaces that model. Nobody is trusted because they are on the practice network or connected to the VPN; each request to each application is checked. If zero trust is new to you, start with what zero trust security is and the NCSC's zero trust architecture design principles (opens in a new tab).
Why zero trust matters in healthcare
| Healthcare challenge | Why traditional access struggles | What zero trust changes |
|---|---|---|
| Locums, agency and visiting clinicians | VPN accounts are slow to set up and often left active after the person moves on | Time-limited, per-app access tied to the person's identity, removed when the booking ends |
| System suppliers and equipment engineers | Remote support tools and shared accounts give broad network access | Access to one named system, approved and logged, ideally through the browser |
| Shared workstations on reception and in clinical rooms | A logged-in PC gives anyone who sits down whatever that account can reach | Each user signs in with their own identity and MFA, and access follows the user rather than the machine |
| Connected medical, building and IoT devices | Imaging, lab and building systems often run older software and sit on the same network as office PCs | Segmentation keeps devices in their own zones, reachable only by the systems that need them |
| Multi-site groups and acquisitions | Each new practice brings its own network and VPN to join up | Per-app access through a cloud broker, without first merging networks |
The common thread is third-party and shift-based access. Most healthcare organisations cannot reduce the number of outside people who need access, so the aim is to make each grant narrow, visible and easy to remove.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
The best approach to zero trust architecture in healthcare
There is no single product that makes a healthcare organisation zero trust. The approach that works for most clinic, practice and care groups follows the order the NCSC's principles suggest: know your users, devices and services first, then authorise each request by policy.
- Identity and MFA first. Give every person, including locums and suppliers, a named account in your identity provider and enforce multi-factor authentication. Retire shared logins wherever the clinical workflow allows.
- Inventory applications and data. List every system reached remotely: practice management, imaging, lab results, rota and HR, finance, email and file shares, with who uses each and how (web, desktop app, remote desktop).
- Per-app ZTNA for staff. Put internal and hosted applications behind a zero trust network access broker, so staff reach only the applications their role needs, after a device check.
- Agentless access for locums and suppliers. People on devices you do not manage get browser-based access to named applications, with no client to install. See agentless ZTNA.
- Segment connected devices. Move medical, lab and building devices into their own segments and allow only the flows they need. Our zero trust network guide covers the design, and microsegmentation vs network segmentation explains the options.
- Retire the old routes. Once applications have moved, close the VPN and any port-forwarded remote desktop access. The NCSC lists legacy routes that bypass the policy engine among its ZTNA anti-patterns (opens in a new tab).
Do it in stages: one site or one team first, then the rest. Our zero trust assessment page sets out how to find your starting point.
The DSPT and NCSC guidance
The NHS Data Security and Protection Toolkit (opens in a new tab) (DSPT) is an online self-assessment tool that lets organisations measure their performance against the National Data Guardian's 10 data security standards. The toolkit's own site says that all organisations with access to NHS patient data and systems must use it to provide assurance that they practise good data security and handle personal information correctly. Many independent providers with NHS contracts fall into that group.
On 9 November 2026 the toolkit site listed the 2026-27 edition as version 9, and it publishes CAF-aligned DSPT audit guidance, which links the toolkit to the NCSC's Cyber Assessment Framework (opens in a new tab). Check the DSPT news page (opens in a new tab) for the edition and deadlines that apply to your organisation type.
Zero trust controls do not complete a DSPT submission on their own, but they produce useful evidence for it: named accounts with MFA, access limited to the systems each role needs, records of who reached what, and separation of devices and networks. The NCSC's ZTNA guidance (opens in a new tab) is a sound reference for the design itself, and our page on the NCSC's zero trust guidance summarises it.
Is zero trust for healthcare the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Products we supply that fit healthcare
| Need | Approach | Products we supply |
|---|---|---|
| Staff access to internal and hosted systems | Client-based ZTNA with device posture checks | Cisco Secure Access (opens in a new tab), Check Point ZTNA, Timus, Todyl |
| Locums, consultants and suppliers on unmanaged devices | Agentless ZTNA or an enterprise browser (opens in a new tab) | Island Private Access, Check Point Enterprise Browser (opens in a new tab) |
| Remote desktops for practice and admin systems | Brokered RDP with MFA and no open ports | TruGrid SecureRDP |
| Connected and legacy devices | Microsegmentation with just-in-time MFA on admin ports | Zero Networks segmentation (opens in a new tab), Zero Networks Connect |
How they differ: Island describes its Private Access (opens in a new tab) as working inside its Enterprise Browser on managed or unmanaged devices, with no agents, portals or VPNs, which suits visiting staff. TruGrid says SecureRDP (opens in a new tab) secures access to Windows desktops and apps without firewall exposure, VPN or gateway appliances. Zero Networks describes network segmentation (opens in a new tab) that keeps admin ports and sensitive systems closed by default and opens them only after just-in-time MFA. Vendor descriptions checked 9 November 2026.
Licensing is usually per user for ZTNA, enterprise browsers and remote desktop brokers, and per protected server, workstation or device for segmentation. Subscriptions can be billed monthly, terms confirmed at quote. Compare every platform on ZTNA providers.
Connectivity and the SASE angle
Zero trust access sits on top of the connections between your sites. If you are also rethinking practice connectivity, web filtering and branch security together, that is a SASE (opens in a new tab) question, covered on our sister site. For the lines themselves, see leased lines for healthcare (opens in a new tab).
How we help healthcare organisations
Forever Systems supplies the zero trust and ZTNA platforms on this site, so we can compare them on fit for your sites, staff and suppliers rather than pushing one product. We can review how remote and third-party access works today, map the systems behind it, recommend an approach, run a pilot with one site or team, and help roll it out in stages. Scope and timescales are confirmed at quote.
Contact us to talk through your organisation's plans.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is zero trust in healthcare?
Zero trust in healthcare is a security approach where no user, device or network is trusted by default. Every request to a clinical or admin system is checked against identity, device health and context, and access is limited to the applications each role needs. It suits organisations with many sites, shift workers and outside suppliers.
What is the best approach to zero trust architecture in healthcare?
Start with identity: named accounts and MFA for everyone, including locums and suppliers. Then put applications behind per-app ZTNA, give unmanaged devices browser-based access, segment connected medical and building devices, and retire the old VPN routes once each system has moved. Roll it out one site or team at a time.
Does zero trust help with the DSPT?
It can provide useful evidence. The DSPT measures organisations against the National Data Guardian's 10 data security standards, and zero trust controls such as MFA, least-privilege access, access logs and segmentation support several of the areas it covers. The submission itself is completed by your organisation on the DSPT site.
How do locums and suppliers get access without a VPN?
Most organisations use agentless ZTNA or an enterprise browser. The person signs in with a named account and MFA, reaches only the applications they are allowed, and nothing is installed on their device. Access can be removed when the booking or contract ends.
Can zero trust protect older medical and lab devices?
Older devices often cannot run security agents, so they are protected by segmentation instead. They sit in their own network segments and only the systems that need them can connect. Some segmentation platforms also require MFA before anyone opens an admin connection to them.
Still have a question about zero trust for healthcare?
Ask us and a member of our team will get back to you.