Public Wi-Fi and Medical Records: When to Use It and When Not To

The airport Wi-Fi, the coffee shop, the hospital's guest network — Indian public Wi-Fi is convenient and often the only option when mobile data is patchy. It's also less safe than most people assume. Accessing medical records over public Wi-Fi is a specific risk category worth understanding, and the mitigations are practical.

What can go wrong on public Wi-Fi

• Man-in-the-middle attacks: attacker on same network intercepts your traffic.
• Rogue hotspots: fake 'Free Airport Wi-Fi' that logs your traffic.
• Session hijacking: capture of session cookies to impersonate you.
• Downgrade attacks: forcing HTTPS to HTTP where possible.
• DNS spoofing: redirecting you to fake login pages.
• Browser exploits pushed through injected content.

What still works safely even on public Wi-Fi

• Reading over HTTPS (green padlock) is generally safe — content encrypted.
• VPN-tunneled connections.
• Well-designed apps with proper certificate pinning.
• Read-only browsing of your own health record if using HTTPS.

What NOT to do on public Wi-Fi

• Log in to sensitive accounts (health, banking, work) without VPN.
• Enter payment information.
• Change passwords.
• Enable file sharing.
• Access anything that would harm you if compromised.
• Trust captive portals asking for credentials to 'connect'.

The VPN recommendation

• VPN encrypts all your traffic between your device and the VPN server.
• Even a compromised Wi-Fi network can't inspect your traffic.
• Reasonable free VPNs exist for occasional use.
• Paid VPNs are inexpensive and more reliable.
• Enable VPN before connecting to public Wi-Fi, not after.
• Choose reputable providers — some free VPNs actually harvest your data (opposite of the point).

The mobile data alternative

• Mobile data (4G/5G) is much safer than public Wi-Fi in most cases.
• Not eavesdroppable by other people around you.
• End-to-end encrypted between phone and carrier.
• If you have data available and it's important, use mobile data instead of Wi-Fi.

The specific captive portal warning

A captive portal is the login page that appears when you connect to public Wi-Fi. Most are legitimate — asking you to accept terms or enter your name. Some are impostor portals asking for social media login, email + password, or other credentials. Never enter credentials on a captive portal unless you're completely sure it's legitimate. The specific test: your regular login shouldn't be needed just to use Wi-Fi.

Hospital and clinic Wi-Fi specifically

• Often shared with staff and patients.
• Often untended — infrequent security updates.
• Convenient for waiting-room use but not automatically safe.
• Better to use mobile data for anything sensitive.
• Hospital's own patient portal may be safe if accessed properly, but avoid on public Wi-Fi.

The specific home Wi-Fi considerations

• Home Wi-Fi is not automatically safe either.
• Change router default password.
• Use WPA3 or at least WPA2 encryption.
• Guest network for visitors (separate from main network).
• Update router firmware occasionally.
• Change Wi-Fi password when contractors, ex-partners, or others no longer need access.

The specific IoT device consideration

• Health devices (BP monitors, scales, glucose meters) increasingly Wi-Fi connected.
• Update firmware regularly.
• Use separate network for IoT if possible.
• Disconnect from Wi-Fi when not in use if concerned.
• Understand what data the device shares and with whom.

For the traveling healthcare user

• Download important documents to your device before travel — offline access.
• Use mobile data for any sensitive access.
• VPN if travel exposes you to unfamiliar networks.
• Emergency contact info accessible without connectivity.
• Insurance card as photo (offline) not just in app.

The specific risk-vs-convenience calibration

• Casual browsing: public Wi-Fi with HTTPS is generally fine.
• Checking non-sensitive email: OK with HTTPS.
• Logging in to health record: use mobile data or VPN.
• Entering payment info: never on public Wi-Fi without VPN.
• Changing passwords: never on public Wi-Fi.
• Emergency access to records: use whatever works — the risk of an eavesdropper matters less than the risk of not having the information.

Public Wi-Fi is a tool with specific risks. The specific mitigation isn't never using it — it's understanding what's safe and what isn't, and having alternatives for the sensitive cases.

References

• CERT-In — public Wi-Fi security
• OWASP — mobile security
• NIST — Wi-Fi security guidance