Solutions/
Healthcare

Mimic Networks for healthcare

Protect EHR and clinical servers from ransomware.

Mimic Networks protects the Windows and Linux servers behind EHR, imaging and interface systems, including ones running software you can't patch yet. It checks each change against the server's known-good profile and stops unauthorized ones at the point of execution. Servers older than Windows Server 2016 or Red Hat Enterprise Linux 8, medical devices and workstations stay out of scope.

October 27, 2026

The servers

The servers healthcare can't afford to lose.

Mimic Networks protects the servers behind clinical care, on Windows Server or Red Hat Enterprise Linux. Each one gets a Mimic node and its own known-good profile, including servers that run software you can't patch yet.

  • EHR application servers. Where clinicians chart, order and read results.
  • EHR database servers. The patient record behind the application.
  • Interface engine servers. The messages between the EHR, the lab, pharmacy and billing.
  • PACS and imaging archive servers. The studies radiology reads and clinicians pull up.
  • Active Directory. The domain controllers clinical and business systems both trust.

Medical devices, workstations, laptops and network devices stay out of scope.

The servers behind clinical care. One Mimic node on each server you choose.Five kinds of hospital servers, from EHR application and database servers to the interface engine, PACS and Active Directory, each with a Mimic node enforcing its own known-good profile. Medical devices and workstations stay out of scope. PROTECTED SERVERS BEHIND CLINICAL CARE CLINICAL EHR application MIMIC NODE DATA EHR database MIMIC NODE INTEGRATION Interface engine MIMIC NODE IMAGING PACS and imaging archive MIMIC NODE IDENTITY Active Directory MIMIC NODE MEDICAL DEVICES, WORKSTATIONS: OUT OF SCOPE
The servers behind clinical care. One Mimic node on each server you choose.Five kinds of hospital servers, from EHR application and database servers to the interface engine, PACS and Active Directory, each with a Mimic node enforcing its own known-good profile. Medical devices and workstations stay out of scope. PROTECTED SERVERS BEHIND CLINICAL CARE CLINICAL EHR application MIMIC NODE DATA EHR database MIMIC NODE INTEGRATION Interface engine MIMIC NODE IMAGING PACS and imaging archive MIMIC NODE IDENTITY Active Directory MIMIC NODE MEDICAL DEVICES, WORKSTATIONS: OUT OF SCOPE
The servers behind clinical care. One Mimic node on each server you choose.

The rules

The rules you answer to.

HIPAA Security Rule, proposed update

Notice of proposed rulemaking, 90 FR 898, published 6 January 2025; still proposed. The 2026 Unified Agenda lists final action for July 2027.

Source: Federal Register and reginfo.gov, read 26 October 2026.

Context. This page carries no patch deadline from the proposal. The integrity standard, 45 CFR 164.312(c)(1), is the rule in force.

Start here

Where healthcare teams start.

Who we help

Who we help.

CISOs

An EHR or imaging server that runs software you can't patch yet still has to stay up for clinical care. Mimic checks each change on it against its known-good profile and stops unauthorized ones at the point of execution.

Servers you can't patch

Infrastructure and server owners

Interface engines and imaging archives feed other clinical systems, so a bad change on one can reach many. Mimic holds each protected server to its known-good profile, so a change outside it stops at the point of execution.

Active Directory protection

Proof

How you'll see it work.

DashCam records each blocked attempt: what it tried to change, when and the process behind it, so a test leaves evidence your team can read afterward.

Limits

Where Mimic stops.

  • Mimic Networks protects Windows Server 2016 and later, and Red Hat Enterprise Linux 8 and later.
  • It doesn't run on laptops, desktops or network devices.
  • In Maintenance Mode, Mimic suspends enforcement and keeps monitoring.
  • Mimic doesn't run on medical devices. Your HIPAA risk analysis and safeguards program stay with your team; Mimic is one control on the servers it protects.

FAQ

Frequently asked questions.

Mimic Networks protects the servers behind clinical systems, from EHR application and database servers to interface engines, PACS and imaging archives. It also protects the Active Directory they trust. It protects Windows Server 2016 and later, and Red Hat Enterprise Linux 8 and later, so check each server against that floor first. You pick the servers and Mimic builds a known-good profile for each one. Medical devices and workstations stay out of scope.

No. HHS proposed updates to the Security Rule on 6 January 2025, including patch management requirements, and the proposal hasn't been finalized. The 2026 Unified Agenda lists final action for July 2027. Until a final rule publishes, this page carries no patch deadline from it, and the integrity standard, 45 CFR 164.312(c)(1), is the rule in force.

No. Mimic runs on servers: Windows Server 2016 and later, and Red Hat Enterprise Linux 8 and later. Medical devices, workstations and laptops stay out of scope. What Mimic protects is the server side those devices depend on, such as the EHR, interface engine and imaging archive servers, where an unauthorized change stops at the point of execution.

The change doesn't execute. DashCam records each blocked attempt: what it tried to change, when and the process behind it, so your team works from facts instead of rebuilding a timeline. On an interface engine or imaging archive, that means a bad change doesn't reach the clinical systems the server feeds. Mimic also feeds enforcement events to your SIEM and SOAR platforms.

See it on your servers.

Start with a demo. Bring the servers you need to protect and the questions your team will ask.

Book a demo