AI Imaging Data Movement and HIPAA Segmentation
A healthcare network is deploying AI diagnostic imaging across three hospitals and a private cloud 40 km away. Each hospital generates 4 TB of imaging data per day, and radiologists expect studies to be available in the private cloud within 15 minutes. The private cloud runs GPU inference and must receive data encrypted in transit; HIPAA requires segmentation from clinical and guest traffic. The hospitals currently connect via 10G MPLS, but the AI team wants 25G or better and is considering dark fiber or IPsec over the Internet. One hospital is in a colocation facility with access to multiple carriers. The security team will not allow AI workloads in the same VRF as clinical systems, and the WAN team worries about encryption throughput at 25G.
1. Recommend an interconnect strategy for the three hospitals and the private cloud.
Read the worked answer
Treat each hospital separately. For the two hospitals with existing fiber paths, dark fiber or a managed wavelength service gives predictable 25G/100G and avoids IPsec throughput limits. For the colocation hospital, use a cross-connect to the private cloud or a carrier-neutral fabric. Keep MPLS as backup where it exists. The reasoning is that 4 TB/day is about 46 MB/s average, but the 15-minute expectation and peak studies make latency and burst capacity the deciding factors. Dark fiber or wavelength is operationally simpler for 25G than IPsec over Internet, while Internet IPsec remains a backup path with measured SLA.
2. How would you encrypt data in transit at 25G or higher, and where would you terminate encryption?
Read the worked answer
Use MACsec on dark fiber or wavelength for line-rate encryption, terminating at the provider or private cloud edge. For any Internet or MPLS path, use IPsec with high-throughput crypto and validate throughput with realistic packet sizes. Terminate encryption at a firewall or router inside the private cloud security zone, not at the GPU host, so policy is centralized. The reasoning is that MACsec is efficient for point-to-point fiber, while IPsec is needed where the underlay is untrusted; the WAN team's throughput concern is valid, so test before committing.
3. Design the segmentation and monitoring for AI, clinical, and guest traffic.
Read the worked answer
Use separate VRFs for AI, clinical, and guest, with a firewall between AI and clinical. Permit only the imaging transfer endpoints and management. Monitor with ThousandEyes or streaming telemetry for latency, loss, and throughput on the AI path, and alert on encryption and segmentation violations. The reasoning is that HIPAA segmentation is not just a VLAN tag; it requires policy enforcement and evidence. Monitoring proves the 15-minute objective and catches drift after changes.