An identity-based microsegmentation implementation at Main Line Health, which operates five hospitals and several ambulatory care locations in Greater Philadelphia, is helping to control how the organization’s roughly 60,000 devices communicate across the network, said Main Line Health CISO Aaron Weismann.
Main Line’s connected devices range from laptops and printers, to devices “including anything from a smart pump at a patient bedside to an MRI in an imaging center,” Weismann said in an interview with Information Security Media Group during the HIMSS 2026 conference in Las Vegas.
Main Line’s microsegmentation deployment aims to protect devices – including legacy gear – at a deep level, said Mick Coady, field CTO at Elisity, the security vendor providing the solution to the healthcare organization.
Imaging machines and other medical equipment may be one to two decades old. These devices often cannot be patched or updated and cannot run security agents, Coady said in the same joint interview.
“So, you’ve got to find a way to manage them critically, leave them up as much as you can for the sake of clinical care, but then protect them and stop lateral movement in the network even if it’s an unpatchable device.”
Main Line’s microsegmentation deployment has “24,000 different rules applying to our devices, what they can and cannot communicate with on the network,” Weismann said.
“We wanted to make sure we had microsegmentation implemented correctly, and to make sure we were protecting those devices using our network tooling,” he said.
In the interview (see audio link below photo), Weismann and Coady also discussed:
- What was involved with Main Line’s “pressure test” of the microsegmentation project to test simulated attacks before going live;
- The ever-evolving nature of microsegmentation in clinical environments;
- Microsegmentation considerations for multi-facility healthcare entities that offer a wide variety of different levels of patient care services.
Weismann has been the CISO for Main Line Health, a health system based in Philadelphia, Pennsylvania, for the past six years. Prior to that, he served as CISO for the Massachusetts Executive Office of Health and Human Services, which provides support and care services for over 3 million Massachusetts residents.
Coady is field chief technology officer at security firm Elisity. He has over 30 years of global experience in privacy, security and operational technology. That includes work with computer task forces worldwide and serving in leadership roles at three of the “Big Four” consultancies – KPMG, Deloitte, PwC – leading forensics and security investigations across public and private sectors. During his decade at PwC, Coady served to consult with CIOs and CISOs with multiple hospitals, where he developed a firsthand understanding of the challenges healthcare organizations face protecting life-critical systems and medical devices.