Reference Architecture Diagram + Narrative (HIPAA-grade care fabric)
┌──────────────────────────────────────────────────┐
│ USERS & ROLES │
Patients │ Home Kits │ Clinicians (MD/RN/NP) │ Admin/RevCycle │ Vendors │
└──────────────┬─────────┬───────────┬─────────────┘
│ │ │
▼ ▼ ▼
┌─────────────────────────────────────────────┐
│ CARE SITES / EDGE LOCATIONS │
│ Hospitals │ Clinics │ Urgent Care │ Home │
├─────────────────────────────────────────────┤
│ SD-BRANCH / SD-WAN EDGE (dual uplinks) │
│ • VLAN/VRF: Clinical │ IoMT │ Admin │ Guest │
│ • Local NGFW/NAC • ZTP • QoS (voice/video)│
└───────────────┬──────────────┬──────────────┘
│ │
Terrestrial DIA / Broadband │ Rural LTE/5G FWA; optional SATCOM
│ │ (policy-based failover)
▼ ▼
┌──────────────────────────────────────────┐
│ TRANSPORT / BACKBONE │
│ DIA ║ Metro Ethernet ║ IX/Peering │
└─────────────┬────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ SASE / SSE POPs (Zero-Trust access fabric) │
│ ZTNA │ SWG │ CASB │ FWaaS │ DLP │ Email Sec │ RBI │
│ Geo/data-residency policies (HIPAA/HITECH, GDPR) │
└───────────┬──────────────────────────────┬───────────────┘
│ │
▼ ▼
┌──────────────────────────────┐ ┌──────────────────────────────┐
│ CLINICAL CORE (SOVEREIGN DC)│ │ CLOUD ON-RAMPS (DX/ER/GCI) │
│ • EMR/EHR • PACS/DICOM │ │ EMR SaaS │ Telemed/UCaaS │
│ • HSM/KMS • IdP/SSO/MFA │ │ Analytics │ Data Lake │
│ • SIEM/SOAR • Backup/Archive │ └───────────────┬───────────────┘
└──────────────┬───────────────┘ │
│ │
▼ ▼
┌────────────────────────────────┐ ┌─────────────────────────────────┐
│ TELEMED & COLLAB (voice/video) │ │ ANALYTICS / AI / RESEARCH │
│ • UCaaS/CCaaS • Recording │ │ • PHI-aware pipelines │
│ • Geo-pinned storage │ │ • Pseudonymization/DeID │
└────────────────────────────────┘ └─────────────────────────────────┘
Telemetry / Observability ─────────► NOC/SOC (AIOps, ITSM/CMDB, Compliance Dashboards)
Narrative (how the care fabric holds together)
1) Purpose & posture
Deliver HIPAA-grade, always-on care across hospitals, clinics, and homes. The posture is Zero-Trust by default, PHI-first data handling, and jurisdiction-aware storage/routing.
2) Edge & transport (syntax)
- SD-Branch/SD-WAN at each site, with DIA + LTE/5G (and optional SATCOM) underlays.
- Deterministic VLAN/VRF segmentation: Clinical, IoMT/biomed, Admin/RevCycle, Guest.
- ZTP to standardize turn-ups; QoS guarantees real-time telemedicine and VoIP.
3) Zero-Trust perimeter (semantics preserved)
- SASE/SSE POPs enforce ZTNA (user+device+posture), SWG/CASB for SaaS, FWaaS/DLP/Email Sec/RBI for PHI protection.
- Geo-pinning ensures PHI stays within approved regions; data-sovereignty policies applied at ingress.
4) Clinical cores & cloud destinations
- Sovereign data centers host EMR/EHR, PACS/DICOM, IdP/HSM/KMS, SIEM/SOAR, and immutable backups.
- Cloud on-ramps (Direct Connect/ExpressRoute/Interconnect) provide private access to EMR SaaS, telemedicine/UCaaS, analytics, and data lakes with De-ID/pseudonymization when required.
5) IoMT & edge care
- Biomed/IoMT devices terminate into the IoMT VRF, authenticated via certs, and proxied through edge gateways for protocol normalization and rate-limit controls.
- Home-care kits ride LTE/5G with ZTNA for just-enough access to telemed platforms.
6) Security & compliance (trust zones)
- Identity-centric access (MFA, device health, least privilege).
- PHI controls: DLP on egress, email encryption, recorded consults geo-pinned; audit-ready logs (HIPAA/HITECH; GDPR when applicable).
- HSM/KMS custody; crypto-erasure procedures for emergency sanitization.
7) Resilience & failover (grammar under stress)
- Policy-based failover DIA→LTE/5G (→SATCOM rurally) with <60s convergence; telemed/EMR prioritized, guest throttled.
- Store-and-forward imaging for PACS during WAN impairment; DRaaS for EMR with pre-staged secondary region.
8) Telemetry, ops & assurance (pragmatics)
- AIOps observability (logs/metrics/traces) streams to NOC/SOC for anomaly detection (video jitter, PHI exfil attempts).
- ITSM/CMDB anchors change control; compliance dashboards expose BAA scope, retention, access trails.
9) Reference KPIs
- Availability: ≥99.99% core; Telemed latency: ≤80 ms; Voice MOS: ≥4.0;
- Failover: <60 s; PHI incident containment: ≤2 h; RTO/RPO (EMR): ≤1 h / ≤15 min.
10) Minimal BOM (from the matrix)
DIA, SD-WAN/SD-Branch, LTE/5G (SATCOM optional), SASE/SSE (ZTNA/SWG/CASB/FWaaS/DLP/RBI/Email Sec), Sovereign DC (EMR/PACS/IdP/HSM/SIEM), Cloud on-ramps, AIOps, ITSM/CMDB.