GCP network design for healthcare application

1. Define Healthcare-Specific Requirements (Foundation Step)

Before touching GCP resources, lock these in:

Security & Compliance

• HIPAA-aligned network isolation

• Encryption in transit (TLS everywhere)

• Least-privilege access

• Full audit logging

Availability

• Multi-zone by default

• Regional design (optionally multi-region later)

Connectivity

• Secure access for:

  • Patients (public)

  • Clinicians (private or VPN)

  • On-prem EHR systems

2. Choose Network Topology (Hub-and-Spoke)

Healthcare apps benefit from centralized security controls.

Pattern

• Hub VPC → shared services & security

• Spoke VPCs → application environments

Why

• Strong isolation

• Easier compliance audits

• Centralized inspection and logging

3. Create VPCs (Network Segmentation)

VPC Layout

Key Settings

• Custom mode VPCs (no auto subnets)

• Private Google Access enabled

• Flow logs ON (required for audits)

4. Design Subnets by Trust Zone

Inside each application VPC:

Rules

• One subnet per region

• No public IPs except load balancers

• Database subnet has zero internet access

5. Control Traffic with Firewall Rules (Zero Trust)

Firewall rules should be explicit and directional.

Ingress Rules

• Allow HTTPS (443) → Load Balancer only

• Allow app traffic only from web subnet

• Allow DB access only from app subnet

Egress Rules

• Default deny

• Allow:

  • Google APIs (via Private Google Access)

  • Required healthcare APIs (FHIR, claims, etc.)

6. Secure External Access (Patients & APIs)

Public Entry Point

• Global HTTPS Load Balancer

• TLS 1.2+

• Cloud Armor WAF:

  • OWASP Top 10

  • Geo-restrictions (if required)

  • Rate limiting

7. Secure Internal Access (Clinicians & Admins)

Options

• Cloud VPN (quick start)

• Dedicated Interconnect (large hospitals)

Pattern

• VPN terminates in hub-vpc

• Traffic routed to app VPC via VPC peering

• IAM + MFA required for clinicians

8. Private Service Access (Databases & APIs)

Healthcare data must never traverse the public internet.

Use

• Private Service Connect

• Private IP for:

  • Cloud SQL

  • Healthcare API

  • Internal microservices

Result

• PHI stays on Google’s private backbone

9. Logging, Monitoring & Audit (HIPAA Critical)

Enable by default:

• VPC Flow Logs (all subnets)

• Firewall rule logging

• Load balancer access logs

• Cloud Audit Logs (Admin + Data Access)

Route logs to:

• Central logging project

• Retention ≥ 6 years (typical healthcare)

10. Disaster Recovery & Resilience

Network-Level Resilience

• Regional subnets (multi-zone)

• Health checks on all services

• Failover backend services

Optional

• Multi-region VPCs

• Cross-region DNS failover

11. Environment Isolation (Prod vs Non-Prod)

Best Practice

• Separate projects per environment

• Separate VPCs

• No peering between prod and non-prod

Why

• Strong compliance boundary

• Reduced blast radius

12. Final Reference Architecture (Summary)

Traffic Flow