Healthcare IAM: Enhance the Clinical Workflow

Short Summary

Identity and access management (IAM) is becoming central to healthcare providers’ business success because digitization and connectivity expand the attack surface while regulators, governments, and the public demand stronger accountability for protecting personal health information. Healthcare organizations cannot meet these pressures with fragmented, home-grown, or manual access controls; they need integrated IAM that covers all connected assets and provides centralized visibility into user activity.

Healthcare’s operating environment adds distinct requirements that generic IAM often fails to meet. Providers must integrate specialized legacy medical devices and applications into modern networks, navigate policy and payment-driven technology shifts (including widespread EHR adoption), withstand elevated cyber threats fueled by the high resale value of medical records, improve patient experience expectations, and increase efficiency amid consolidation. The most critical constraint is that security controls must not disrupt clinical workflow. Hospital work is unusually complex: clinicians may handle many patient cases per shift, move between locations, use numerous devices, and rely on multiple applications. As a result, they can be forced to authenticate dozens of times per shift using different credentials, losing time and attention that should be focused on patient care.

Effective healthcare IAM must reduce login friction (e.g., tap-and-go and fast reauthentication), provide flexible and compliant provisioning across many systems and devices (including for mergers, staff reassignments, and temporary clinicians), support hybrid cloud adoption while still protecting on-premises medical equipment, integrate deeply with leading EHR platforms, and meet DEA requirements for electronic prescribing of controlled substances with usable MFA options.

Imprivata is positioned as a healthcare-specialized IAM vendor emphasizing workflow-friendly SSO, role-based governance, and MFA tailored to clinical and EHR/EPCS use cases, including integrations with Epic, Cerner, and Microsoft Azure AD.

Interesting Facts

• Complete medical records can sell for as much as $60 apiece on the dark web, while Social Security numbers sell for about $15 and stolen credit cards for $1 to $3.
• Healthcare mergers and acquisitions hit a record high in 2018, with more than 400 deals announced in Q3 2019.
• A physician or nurse in a single shift may deal with 18 patient cases and use up to 14 different software applications across multiple locations.
• Government-driven adoption of EHR systems among non-federal acute care hospitals reached 95% in 2017, a nine-fold increase in seven years.
• A clinician may have to authenticate around 70 times in a single work shift, often with different ID/password combinations.
• A hospital system replacing password-based login with tap-and-go technology estimated savings of over 49,000 hours annually across 19 facilities.
• The average cost of a healthcare data breach in 2017 was estimated at more than $3.62 million per incident.
• In 2018, five leading EHR vendors accounted for 85% of the market within 5,447 acute care hospitals in the US: Epic 28%, Cerner 26%, MEDITECH 16%, CPSI 9%, Allscripts 6%.
• Locum tenens (temporary contract) physicians were used at 94% of healthcare facilities in 2016.
• Imprivata was founded in 2002, had over 450 employees, and reported approximately $200 million in 2018 revenue.

Notable Quotes

• “The delivery of health care is founded on the establishment of a trust relationship between and among providers and patients.”
• “The foundation of this trust is the belief and confidence in the identities of the individuals involved.“
• “doctors . . . do not want security interfering with their workflows.”
• “dual factor authentication, as done traditionally, might slow down a doctor who is treating a critical patient”
• “In a healthcare environment, [Imprivata OneSign] can offer an increase in productivity and time savings . . . care providers can spend less time with technology and more time focusing on what matters most – patient care.”
• “Contrary to the popular saying that ‘security is everybody’s business,’ the physicians and nurses in a hospital believe that their business is saving lives.”
• “Small and medium-sized health care providers should evaluate options to migrate patient records and legacy systems to secure environments (e.g., hosted, cloud, shared computer environments).”
• “Eliminating the clinical work-hours lost and the distraction of frequent interruptions created by the requirement for ubiquitous user access control is the most important goal of an IAM system for healthcare providers.”