HIPAA Analytics: Least Privilege and PHI Exfiltration Controls
CarePath Health runs a HIPAA-regulated analytics platform for 200 analysts across 14 Google Cloud projects. PHI resides in BigQuery and Cloud Storage in us-central1. The company uses on-premises Active Directory and has no Cloud Identity groups beyond a few pilot ones. Investigators recently found three service account keys in a public GitHub repo and blocked a near-miss export of a BigQuery table to a personal Cloud Storage bucket. Audit logs are retained for 30 days, and VPC Service Controls are enabled only in two projects. The CISO wants least-privilege access, prevention of data exfiltration, customer-managed encryption keys, and six-year audit retention. Analysts need to query PHI from approved corporate devices but must not download row-level data. The security team is small and cannot review every IAM change manually.
1. Design the identity and access model for 200 analysts and the platform teams. How do you federate Active Directory, enforce least privilege, and eliminate long-lived keys?
Read the worked answer
Identity foundation
Use Cloud Identity as the Google Cloud identity source, federated to on-premises AD through SAML SSO. Sync users and groups from AD with Google Cloud Directory Sync or an equivalent process so group membership follows the existing joiner/mover/leaver process. Do not manage 200 individual IAM bindings manually.
Group and role design
Create groups by job function and data sensitivity: analysts-phI-approved, data-engineers, platform-admins, security-auditors, and break-glass. Bind groups at the folder or project level, not to individuals. Analysts get BigQuery Job User at the project and BigQuery Data Viewer only on authorized views or datasets, not on raw PHI tables. Use column-level policy tags for direct identifiers and row-level security where row filtering is required. Data engineers get broader dataset access but not KMS administration.
No long-lived keys
Apply an organization policy to disable service account key creation except in a break-glass project. Migrate workloads to Workload Identity Federation for GitHub, Cloud Build, or on-premises workloads. For human automation, use service account impersonation with short-lived credentials. Remove the three exposed keys: rotate, deploy replacement credentials, disable, then delete. Add alerting on any key creation or IAM change.
Keeping review manageable
Use IAM Conditions for time-bound and resource-scoped access, deny policies for high-risk permissions such as bigquery.tables.export, and Access Context Manager access levels for approved corporate devices or networks. Automate drift and privilege-creep checks against a baseline so the small security team reviews exceptions rather than every binding.
2. Design controls to prevent PHI exfiltration and meet the CMEK requirement. Address BigQuery, Cloud Storage, VPC Service Controls, and key management.
Read the worked answer
Perimeter first
Put all 14 projects that hold or can access PHI into a VPC Service Controls perimeter around BigQuery, Cloud Storage, and Cloud KMS. Add ingress and egress rules only for approved identities and projects. The near-miss export to a personal bucket should be blocked by the perimeter because the destination project is outside the perimeter. Combine this with Access Context Manager access levels for corporate devices or networks.
BigQuery controls
Analysts query authorized views rather than raw tables. Use policy tags to mask or deny direct identifiers, row-level security where appropriate, and IAM deny policies to block export and dataset copy permissions for analyst groups. Do not grant dataset owner or BigQuery Data Owner to analysts. Log and alert on export jobs, table copies, and new dataset access.
Cloud Storage controls
Enforce public access prevention and uniform bucket-level access. Keep PHI buckets private, use CMEK, and grant access through groups. Use VPC Service Controls and IAM deny policies to reduce the chance of copying data to unapproved buckets. Run Sensitive Data Protection discovery on buckets and BigQuery to find unlabeled PHI.
CMEK
Create Cloud KMS key rings in us-central1 with separate keys for BigQuery, Cloud Storage, and logs. Set rotation and separation of duties: the security team manages KMS IAM; data teams cannot administer keys. Use CMEK on BigQuery datasets and storage buckets. Document that CMEK protects data at rest but does not replace IAM or perimeter controls.
Residual risk
No control fully prevents a user from viewing and manually transcribing query results. The practical goal is to prevent bulk export, restrict access to approved devices, and detect anomalous query volume.
3. Design audit logging, retention, and monitoring for a small security team. How do you retain logs for six years and detect the highest-risk events?
Read the worked answer
Centralized log architecture
Create a dedicated logging project owned by security. At the organization level, create aggregated log sinks to a log bucket in that project. Include Admin Activity, Data Access, System Event, and policy denial logs. Use a separate sink to BigQuery for analysis and a storage bucket for long-term retention. Apply CMEK to the log bucket and restrict access to security roles.
Retention
Set the log bucket retention to six years and lock the bucket to prevent tampering. Understand that locked retention cannot be shortened, so validate the cost and legal requirement first. Use lifecycle rules on the BigQuery copy for cheaper analysis, but keep the authoritative immutable copy in the locked bucket.
Detection priorities for a small team
Alert on: service account key creation, IAM policy changes at folder or organization level, VPC Service Controls violations, BigQuery export or copy jobs, public bucket IAM changes, KMS key disablement or destruction, and unusual BigQuery data scanned per user. Route high-severity findings to the on-call security channel. Use Security Command Center findings where available rather than building every detector from scratch.
Operating cadence
Review exceptions weekly, not every IAM binding. Maintain a short runbook for each alert: who owns it, what evidence to collect, and when to disable a principal. Test the logging pipeline by generating a controlled denied export and confirming it appears in the central project. Retention without detection and response is just storage cost.