I too am trying to implement a wireless option in some of the clinical areas in our hospital. The VPN solution is what we tried first. We set up a large concentrator on the back end (but not big enough as it turned out) set up client based authentication using LDAP. It is pretty easy for the user to figure out, and since it is LDAP they do not have to know another password (they have to remember medical stuff and not a bunch of passwords one doc told me) The draw back that we are finding is that the concentrator that we thought was good is not big enough for our needs.
We are looking at PEAP as a more secure way. I know that most of the standard wireless cards are upgrading to the latest version of this (Dell released a patch in the past couple of weeks for theirs). The Microsoft flavor tries to rule over all of them, and is not very good at it right now (I know you are all shocked). Once removed other clients can be used, from stand alone software like the one from Meetinghouse or just configurations on the card itself like in the new Dell drivers.
The other option is hardware at the access point. There are several companies that have tackled this by putting, what is basically, a fire wall at the access point. So that it sits between the access and the 'wired' network. Some of these are set to have authentication, again with LDAP or AD, etc... The draw back on these that we have seen is so far they do not span subnets very well. In a smaller network setting it would be great, but in the larger ones it starts to become cost prohibitive.
I hope this helps. Any one else feeling the HIPAA pain with wireless?
