Getting a handle on identity and access in healthcare isn't just a technology problem

For a healthcare organization, managing identity and access is as much of a process problem as it is a technology problem.

The challenge organizations face, in healthcare and in other industries, is that each person in the ecosystem needs one identity attached to them; otherwise, managing and keeping track of staff across the vastness of an enterprise becomes an almost impossible complex undertaking.

Erik Decker, chief information security and privacy officer at University of Chicago Medicine, told a crowd at the Healthcare Security Forum in Boston Monday that this starts with systems of codes and processes. One of the obvious ones is an employment records system.

In this system, everyone is prescribed an ID that identifies who they are. And if the organization is a university or teaching hospital, student information needs to be tracked as well, in addition to any contractors who are working on site.

"You might be a physician who's credentialing through a different system," said Decker. "All that's got to come together and be de-duplicated.

"Then you can start tying your access credentials onto that identity," he said. "Those credentials can be tracked and managed accordingly. The joiner, mover, leaver construct -- with people joining the organization, moving around and then leaving the organization -- can only be automated if you build this construct first. Otherwise, you will be immediately out of sorts and orphaned, and you won't be able to keep track of everybody."

Phil Alexander, chief information and security officer at North Mississippi Health Services, also speaking on the panel, extolled the virtues of automation to coordinate identity and access, but warned that a business should identify blind spots before de-manualizing certain processes.

"If you automate something that's broken, you're going to get garbage in, garbage out," said Alexander. "You've got to figure out what you don't know."

It's about building the foundation of who's getting access. North Mississippi Health Services used employment records as a baseline for automation, allowing the enactment of role-based access. That generated a list of who gets access to what. A separate system was created for non-employees.

"When you start automating, you get your stuff in order," said Alexander. "You start eliminating not just bad processes in IT but in HR and staff. They think it's breaking their processes, but it's illuminating bad processes. You have to bring people into the process."

Carol Babachicos, senior vice president and chief information officer at South Shore Health, likened the concept to having a Social Security number -- a powerful identifier that prevents a person from getting lost in the shuffle.

To automate identity, though, the information on file needs to be correct.

"As you're creating these profiles, you want to do a double-check, because it's automation, and automation isn't perfect," said Babachicos. "The information should come from a source of truth."

Twitter: @JELagasse

Email the writer: jeff.lagasse@himssmedia.com