Healthcare Zero-Trust Resilience Architecture (HZTRA): A Practitioner-Led Reference Model for Securing Hospital Information Systems

Abstract

Background: Hospitals are rapidly adopting electronic health records, connected medical devices, and telehealth platforms, which has expanded their digital attack surface and exposed them to frequent cyber incidents such as ransomware and data breaches. Traditional perimeter-based security architectures are increasingly inadequate for protecting complex, highly connected clinical environments. Objective: This article introduces the Healthcare Zero-Trust Resilience Architecture (HZTRA), a practitioner-developed zero-trust cybersecurity reference architecture tailored to hospital information systems and connected medical devices. The goal is to capture, in a reusable form, design patterns that have already been applied in large hospital networks to improve resilience against cyberattacks while preserving clinical workflows. Methods: A narrative review of the healthcare cybersecurity literature was combined with lessons learned from leading the design and rollout of hospital information systems and security controls in multi-hospital environments. Insights from published research on cyberthreats, medical device vulnerabilities, and zero-trust frameworks were synthesised with implementation experience to derive a pragmatic reference architecture that reflects typical hospital technology stacks, network topologies, and operational constraints. Results: The HZTRA organises hospital cybersecurity into five integrated domains: identity and access management, network micro-segmentation, medical device and Internet of Medical Things protection, application-level controls for critical clinical systems, and continuous monitoring with incident response. Each domain is mapped to common hospital components such as electronic health records, diagnostic systems, and bedside devices, demonstrating how zero-trust policies can be applied end-to-end in real deployments. Conclusions: Adopting the HZTRA can help hospitals reduce lateral movement opportunities for attackers, limit the impact of successful breaches, and enhance overall cyber resilience. Because the model distils patterns proven in large-scale projects, it provides chief information officers, security architects, and clinical leaders with a credible, experience-based blueprint for planning phased adoption of zero-trust in hospital environments and a concrete reference point for evaluating cybersecurity strategies.