Long term planning for authentication solutions - Viewpoint

Health Management Technology, Dec, 2001 by Taylor Boon

Advanced end-user authentication is a hot topic in the healthcare industry right now, and for good reason. As healthcare organizations integrate access to information from multiple sources, including hospitals, physician offices, partners, payors and patients, developing a strategy for authentication and access privileges within an integrated environment becomes critical. With the continual removal of non-electronic means, all access privileges are increasingly tied to security and confidentiality.

Among the factors prompting organizations to consider new authentication solutions are online security for patient records, convenient information access for caregivers, and regulations such as the forthcoming HIPAA, which are mandating processes and policies that enforce scrutiny that did not exist until now.

Each of these factors alone will prompt a healthcare organization to abandon password-centric security. Finding an alternative authentication solution that meets all three requirements within an integrated system, however, may leave healthcare CIOs feeling like they are working at cross-purposes.

The complexity of the factors driving advanced authentication brings to mind that old adage--stop, look and listen. No other security solution is likely to impact an organization's existing workflow processes more than the authentication measures used to verify the identity, authority and access privileges of users. Taking a careful look at your existing policies, procedures and environment can save you pain during implementation and, more importantly, ensure that your authentication solution meets your needs in the years to come.

One Size Doesn't Fit All

One of the first considerations when contemplating an authentication solution should be workflow processes currently in place and how those would be affected by the introduction of different authentication methods. Nowhere is this more important than in areas of patient care.

If a caregiver needs immediate access to online patient records, seconds count. On the hospital floor, a proximity card, which automatically presents the user's credentials, followed by a fingerprint scan, is likely to be a successful option. In an operating room, where caregivers wear masks and gloves, iris recognition may be the most suitable.

In the billing department however, time is not as critical. Users accessing sensitive records could be required to type in their user name and then verify their identity with one or multiple authentication methods. By taking into account the needs of your users and the environments in which they work, you can implement an authentication solution that enhances security while providing convenient, authorized access.

Complex Application Environments

Another key consideration is the nature of your application environment. As healthcare organizations move to an increasingly digital environment, an integrated delivery system requires the support for a wide variety of applications--legacy, client-server and Web-based. Vendor independence in the types of applications being deployed becomes extremely important.

The complexity created by such a heterogeneous application environment is exacerbated by the number of application-specific identities that must be reconciled. When reviewing authentication solutions, consider how application-specific identities and privileges are managed. In a highly complex environment, the ability to manage authentication to specific applications with context-based policies is crucial.

The distributed environment of an enterprise--organizationally, geographically and technologically--also has far-reaching implications for an authentication system. As computing becomes more pervasive, users access information from a variety of channels. Doctors may sign off on hospital charts from their home office, and lab results may be transmitted electronically.

Add to this the increasing use of PDA and other wireless devices and it becomes clear that users will soon have multiple means of accessing sensitive healthcare information. Just as an internal healthcare environment must be evaluated when deploying an authentication solution, so too must the external environment, for access needs that are both immediate and anticipated.

Long-term Strategy

Once you have surveyed your existing environment, designing a long-term strategy will not seem as daunting. The following key points will ensure that you achieve maximum flexibility as your integrated delivery system grows.

Centralize authentication management, delegate administration. Centralized authentication management, with the ability to delegate certain administrative rights, will enable you to manage your authentication based on existing roles and responsibilities. For example, one designated administrator may be responsible for user enrollment, while another manages authentication policies for specific applications or network resources.

Implement flexible authentication policies. Authentication policies should be tailored to users' existing practices and provide all access privileges required for optimal job performance. The ability to balance practicality and security will be the key to rapid adoption of any policies you implement. You will need the flexibility to support authentication policies that not only support the multiple roles and responsibilities of caregivers, but also do not mandate security at the cost of convenience.