Electronic Health Reporter

Guest post by Dean Wiech, managing director, Tools4ever.

Identity and access management (IAM) in healthcare continues to be a growing part of the industry. The management of identities, user accounts and access to both data and applications is a large task for hospitals and healthcare organizations. In the healthcare industry especially, the need to follow strict access and security rules and regulations exists, which makes IAM even more challenging. This need has led to newer solutions to meet the needs of healthcare organizations.

Here are the top four account management issues in healthcare that can be significantly improved:

Onboarding of Employees

The first issue that many healthcare organizations face is efficiently onboarding new clinicians and employees. For example, when a new doctor or nurse begins employment, they need their account created, and the correct access to the systems and applications they require in order to assist patients. The issue is, too often, new employees are waiting idle while all of their access and accounts are created.

By streamlining and automating the account management processes, this issue can be improved. Automating the process allows administrators to easily enter new employee’s information into a source system, such as the HRM system and check off which systems the employee needs access to and accounts in; and the new accounts are automatically created.

Changes to Accounts

Next, there is the issue of movement or changes to an employee account throughout their employment. Often, clinicians need to contact their manager to ask for permission for a change to or additional access, who then in turn needs to contact IT or HR to have the change carried out.

IAM software with workflow management capabilities has evolved to assist with this situation. A web portal with workflow can be set up so that employees can easily request changes to their account and then have it securely carried out.

As an example, a nurse moves to a different unit, or floor, and needs access to a different set of data or applications. A nurse can easily request the access through a portal and the request is automatically sent to the correct people for approval. Once the approval is given, the change automatically is made. If the request needs multiple levels of approval, it will move to the next person in line. In addition, all of these changes are logged so that the healthcare organization knows exactly what changes are made, when they were made and who approved them.

Healthcare Compliance and Audits

Another requirement in healthcare is ensuring that compliance is met and that the important information is kept secure. Healthcare organizations need to ensure they are HIPAA compliant, as well as meeting many other security laws and regulations.

While having security measures in place is extremely important, it is also important that there is a frequent check on these measures to ensure that everything it accurate. One way this can be achieved is to double check that access rights for all employees in the organization are correct. This can be a daunting task for an organization with hundreds or thousands of employees. Many IAM solutions easily allow a report to be generated to ensure that there is a check on access rights, which is sometimes referred to as attestation. This report can be set up to automatically be generated and sent to the appropriate manager.

This type of report allows the manager to easily see who has access to which systems and applications within their department, as well as any changes that have been made. If the report is accurate, the manager can then electronically sign off on it, ensuring compliance. If changes need to be made, they can easily revoke access or make any of the appropriate changes required. This attestation process ensures that not only are the security processes in place working, but that also someone has recently reviewed the access rights and confirmed everything is accurate.

Ensuring accounts are efficiently disabled

Lastly, when considering IAM in healthcare, it is important to ensure that accounts are promptly disabled once an employee is no longer with the organization. This process is often overlooked since an account administrator needs to go into each system and application and manually disable the accounts. Often, the account is accidently left active in one or more systems, which can lead to security issues if an employee leaves the organization and still has access to secure patient information.

Automated account management solutions can easily ensure this does not happen by allowing an administrator to easily disable an account in the source system, and then all connected accounts are automatically disabled.

Overall, IAM in healthcare continues to grow because it allows them to streamline and automate account management processes for efficiency, as well as allow for a reporting system to ensure that the security measures are working properly. This overall allows for one solution to manage the entire user account lifecycle.