Merging Hospital Networks After M&A: A Security Integration Checklist
Connecting two hospital networks means inheriting every unpatched system and orphaned account the other side has. Sequencing the integration so you find out before you connect.
GuardsArm Team
Security Experts
The day two hospital networks connect, each inherits the other's security posture in full — every unpatched device, every orphaned account, every undocumented vendor tunnel. Integration is usually driven by a clinical and financial timetable that was set before anyone assessed the other side's environment, and security is asked to enable connectivity rather than to qualify it.
Diligence before close, where you can get it
Security diligence in healthcare M&A is usually shallow — a questionnaire and a policy review. What is actually worth asking for:
- Incident history, including anything unreported, with a warranty
- Current risk analysis and the associated risk management plan
- Unsupported system count, by clinical service
- Outstanding regulatory matters — OCR investigations, state actions, consent decrees
- Cyber insurance — policy, claims history, and whether it survives the transaction
- Recent penetration test or assessment, with remediation status
- Third-party and vendor inventory, since you inherit those relationships too
Where access is limited before close, an external attack surface review needs no cooperation at all and frequently tells you something the questionnaire did not.
Stage the connectivity
The mistake is a full network join on day one because clinical teams need access to something. Stage it instead.
Brokered access is the key idea. Clinical staff usually need a handful of specific applications, not general network reachability. Publishing those through a gateway delivers most of the operational benefit while deferring the risk transfer until you understand what you are accepting.
Identity is the hardest part
Two directories, overlapping people, different naming conventions, different password policies, and a long tail of accounts nobody can explain.
| Step | Watch for |
|---|---|
| Inventory both directories | Accounts with no HR record on either side |
| Identify duplicate humans | One person, two identities, different privilege on each |
| Baseline privileged accounts | The acquired side's domain admin count is usually a surprise |
| Establish trust carefully | A forest trust extends compromise in both directions |
| Consolidate, do not merge blindly | Migrating accounts wholesale imports the debt with them |
| Clean up leavers first | See contractor identity governance |
Do not establish a forest trust as the first integration step. It is the quickest way to give clinical staff access and it makes a compromise on either side a compromise of both, before you have assessed either.
What to fix before connecting
A short, non-negotiable list — the things that turn a local incident into a shared one:
- MFA on all remote access, both sides
- No unsupported systems with internet exposure
- Backup immutability verified on both estates
- EDR deployed and reporting on the acquired endpoints
- Vendor remote access inventoried and brokered
- Known-exploited vulnerabilities remediated
If the timetable does not allow all of it, connect through the brokered stage and keep the estates separated until it does.
Where to start
Ask for the unsupported system count and the domain administrator count on the acquired side. Two numbers, both quick to produce, and together they predict how much integration work is actually ahead of you better than any questionnaire.
GuardsArm supports healthcare M&A security integration, including pre-close assessment and staged connectivity design. Book a scoping call.
Written by GuardsArm Team
Our team of cybersecurity experts brings decades of combined experience in penetration testing, compliance auditing, and incident response. We're dedicated to helping organizations strengthen their security posture.
Take the next step on this topic
Talk to the GuardsArm team about how these services apply to your environment.
