Alright, let's cut to the chase. We're a healthcare-focused company with about 500 users, heavy on remote clinicians and admin staff. HIPAA is our daily bread, and our current VPN is a performance and audit nightmare.
We're evaluating ZTNA solutions, and Zscaler ZPA is obviously on the shortlist. The promise of app-specific access instead of network-level seems perfect for our compliance needs. But before I get lost in another sales demo, I want the real-world breakdown.
Specifically for a mid-market healthcare org:
* **Policy granularity:** How fine-grained can you get with access controls? Can you tie it to AD groups *and* device posture *and* location? We need to lock down PHI like Fort Knox.
* **App onboarding complexity:** We have a mix of legacy on-prem apps (think old but critical patient scheduling), modern SaaS (our EHR's web portal), and cloud VDI. What's the lift to get these into ZPA?
* **Performance & user experience:** Clinicians will revolt if chart loading adds latency. Any measurable impact vs. direct access?
* **The cost trap:** The per-user pricing seems straightforward until you start adding connectors and needing high availability. What's the *real* TCO for a setup like ours?
I've started a comparison spreadsheet (of course) but I'm missing the nitty-gritty on ZPA's day-to-day management and those "gotcha" moments. How does it handle when a doctor needs emergency access from an unmanaged device? What's the logging and reporting like for our compliance audits?
Also curious about alternatives you considered. I'm looking at Palo Alto Prisma Access and Citrix Secure Private Access, but the healthcare-specific use cases are hard to find. Any fellow healthcare IT folks here who've been through this?
Spreadsheets > marketing slides.
I work as a junior DevOps engineer at a regional clinic network (around 300 users). We migrated from a traditional VPN to Zscaler ZPA about eight months ago to handle our hybrid workforce and PHI access. It's in prod for our core apps now.
**Policy granularity:** You can get very specific. We tie access to an AD security group for the app, then layer on a posture check (CrowdStrike integration) *and* a network location rule. The policy builder uses AND/OR logic, so you can do things like "Group A AND (Corporate IP OR Compliant Device)". HIPAA audit trails are clear.
**App onboarding complexity:** It varies. A modern SaaS app took 15 minutes. Our legacy on-prem scheduling app (IIS-based) took a half-day because we had to set up a ZPA Connector in its subnet and tweak some TCP forwarding rules. Cloud VDI was straightforward. The lift is mostly in configuring the Connectors for HA, not the app definitions themselves.
**Performance & user experience:** For web apps, most users see no difference. The first request to an app through the service edge can add 80-120ms, but subsequent requests are fine. We measured it. For bulk file transfers through TCP-segmented apps, it's about 10-15% slower than direct LAN access, but not enough for user complaints.
**The real cost trap:** The list is ~$7/user/month for the bundle. You need at least two Connectors per location for HA, and they're just VMs you host. The hidden cost is in management time. If you have a ton of unique, low-traffic legacy apps, each one needs a segment, which adds policy overhead. Budget for 2-3 months of gradual rollout and tuning.
I'd recommend ZPA for your use case, specifically for locking down PHI access to web and TCP-based apps from unmanaged devices. If you have a huge number of legacy, non-web apps (like thick clients talking directly to databases), tell us that, because the segmentation work gets heavy.