Mimic Networks for healthcare
Mimic Networks protects the Windows and Linux servers behind EHR, imaging and interface systems, including ones running software you can't patch yet. It checks each change against the server's known-good profile and stops unauthorized ones at the point of execution. Servers older than Windows Server 2016 or Red Hat Enterprise Linux 8, medical devices and workstations stay out of scope.
The servers
Mimic Networks protects the servers behind clinical care, on Windows Server or Red Hat Enterprise Linux. Each one gets a Mimic node and its own known-good profile, including servers that run software you can't patch yet.
Medical devices, workstations, laptops and network devices stay out of scope.
The rules
Notice of proposed rulemaking, 90 FR 898, published 6 January 2025; still proposed. The 2026 Unified Agenda lists final action for July 2027.
Source: Federal Register and reginfo.gov, read 26 October 2026.
Context. This page carries no patch deadline from the proposal. The integrity standard, 45 CFR 164.312(c)(1), is the rule in force.
Start here
Who we help
An EHR or imaging server that runs software you can't patch yet still has to stay up for clinical care. Mimic checks each change on it against its known-good profile and stops unauthorized ones at the point of execution.
Interface engines and imaging archives feed other clinical systems, so a bad change on one can reach many. Mimic holds each protected server to its known-good profile, so a change outside it stops at the point of execution.
Proof
DashCam records each blocked attempt: what it tried to change, when and the process behind it, so a test leaves evidence your team can read afterward.
Limits
FAQ
Mimic Networks protects the servers behind clinical systems, from EHR application and database servers to interface engines, PACS and imaging archives. It also protects the Active Directory they trust. It protects Windows Server 2016 and later, and Red Hat Enterprise Linux 8 and later, so check each server against that floor first. You pick the servers and Mimic builds a known-good profile for each one. Medical devices and workstations stay out of scope.
No. HHS proposed updates to the Security Rule on 6 January 2025, including patch management requirements, and the proposal hasn't been finalized. The 2026 Unified Agenda lists final action for July 2027. Until a final rule publishes, this page carries no patch deadline from it, and the integrity standard, 45 CFR 164.312(c)(1), is the rule in force.
No. Mimic runs on servers: Windows Server 2016 and later, and Red Hat Enterprise Linux 8 and later. Medical devices, workstations and laptops stay out of scope. What Mimic protects is the server side those devices depend on, such as the EHR, interface engine and imaging archive servers, where an unauthorized change stops at the point of execution.
The change doesn't execute. DashCam records each blocked attempt: what it tried to change, when and the process behind it, so your team works from facts instead of rebuilding a timeline. On an interface engine or imaging archive, that means a bad change doesn't reach the clinical systems the server feeds. Mimic also feeds enforcement events to your SIEM and SOAR platforms.
Related
Start with a demo. Bring the servers you need to protect and the questions your team will ask.