Improve and Secure Healthcare Delivery With Digital Identity

Healthcare organizations often interact with diverse and sometimes distinct populations through their online portals. Patients and members of different age groups and backgrounds, along with providers, billers, brokers and researchers, all utilize health portals for a variety of reasons.

Many healthcare organizations struggle with providing intuitive online journeys for these disparate populations. This is often a function of the limited options available from their current identity and access management solutions. These legacy and often homegrown solutions weren’t designed for today’s demands.

The Ping Identity Platform can help you deliver the intuitive journeys your patients and members expect. It offers a range of registration, authentication and self-service options that you can customize to serve the needs of each user population. Figure 2 provides an overview of the options that can be delivered by the Ping Identity Platform, while Figure 3 illustrates how you might address members versus providers.

Figure 2: The Ping Identity Platform provides mix-and-match capabilities to meet the needs of diverse user populations.

 

Figure 3: Examples of how you might structure capabilities to meet the requirements of members vs. providers.

Healthcare organizations aren’t immune to the customer experience (or CX) trend that’s dominating the traditional business world. The importance of CX is seen in the transformation of health portals, which were once little more than digital portfolios of information, into full-on customer engagement centers. What formerly were places to view bills and lab results are now avenues to chat with your doctor and track health metrics in real time.

Evolving your enterprise from predominantly providing information access to delivering true patient and member engagement is anything but easy. For starters, you don’t just have your own resources to manage, but you must also address dozens—maybe even hundreds—of third-party apps and APIs. To further complicate matters, your patient and member data can become increasingly scattered and disjointed as your channels of health engagement multiply. And on top of all of this, you must provide patients the ability to manage consent for every resource and person with access to their data.

The Ping Identity Platform makes these seemingly daunting challenges much simpler to solve.

Provide Single Sign-on for All Users and Resources

To give your patients and members single sign-on (SSO) to your expanding portfolio of health apps, APIs and third-party resources, you need a robust set of identity federation capabilities. The Ping Identity Platform, specifically PingFederate, provides the flexibility to connect any identity to any application or API with federation hub capabilities. You’re able to connect diverse populations of patients, members, providers, brokers and researchers to any application they require. And with built-in support for identity standards like SAML, WS-Fed, WSTrust, OAuth and OpenID Connect, you’re ensured of the interconnectivity you need with third parties.
 

Figure 4: PingFederate provides the flexibility to connect any identity to any application or API.

 

Unify Health Profiles with Centralized Sharing Options

Imagine a patient or member takes a health assessment one week, chats with a wellness coach the next week and receives virtual care shortly after that. Now, imagine how easy (or difficult) your current platform makes it for this same person to retrace their steps and find important information about these activities a few months later.

PingDirectory, Ping Identity’s secure directory, can synchronize data from select applications to personalize patient and member experiences. Its flexible schema accommodates unique health attributes to present a unified health profile.

Once a unified patient profile is assembled, PingDataGovernance enables user-friendly data sharing with health proxies. After capturing consent, PingDataGovernance can also enable and enforce policies around the sharing, viewing and managing of health profile data by certain providers and dependents.

Figure 5: How PingDirectory and PingDataGovernance work together to enable a unified profile and enforce policies.

You already understand that patient and member data needs to be secure. But privacy is another aspect of security that deserves a closer look. Because of the personal nature of information shared with healthcare providers, your users might be wary of using your digital properties. In a world where one’s personal online activities are sometimes made public, your patients and members may fear that inadvertently leaving a browser open or a phone unlocked could reveal confidential information to a friend or family member, or worse yet, someone with ill intent.

PingID, the Ping Identity Platform’s cloud-delivered MFA solution, can be offered as an optional measure for patients to enable another layer of security to access their online health profiles. Additionally, the PingID mobile SDK can be embedded in mobile apps to provide an extra layer of privacy by requiring an additional authentication to view sensitive health and profile data, like prescription notifications.
 

Figure 6: The PingID mobile SDK can provide additional security by requiring additional authentication to access sensitive data.
 

You may think that an improvement in security and privacy must naturally result in a diminished user experience. While this once held true, you no longer need to sacrifice experience to optimize security. Using adaptive authentication, PingID can be customized to step up authentication for higher-risk transactions only, such as editing or deleting PHI. Supporting popular user-friendly mobile push notification options—including swipe to authenticate, fingerprint and Face ID—PingID can be customized to notify users of the changes being requested before they’re made.

PingID also enables patients and members to self-manage a network of trusted devices approved for access to their health data. When an unrecognized device is used for access, PingID can require an additional authentication before granting access. These flexible authentication methods support a wide range of use cases, enabling you to improve user experiences for your patients and members, while maintaining their privacy and security.

New partnerships, mergers and acquisitions are often formed with projected timelines of when the joint entity will be fully operational. Often, these projections fail to capture the difficulty of providing access to diverse resources. Providing only a surface-level view, they don’t adequately account for the complexity of managing and securing access to multiple domains for a variety of roles.

You’ll find support for your identity and access management integration challenges in the Ping Identity Platform.

Federation Hub: PingFederate and PingOne connect any identity to any application or API with federation hub capabilities. Your employees can connect to any acquired or partner application, or API, in any domain, and vice versa.

Hundreds of SaaS Integrations: Combine federation hub capabilities with out-of-the-box connectors to Office 365, SalesForce, Dropbox, ServiceNow and others to immediately connect your newly acquired identities to resources.

Dozens of Enterprise Integrations: Federation hub capabilities also enable out-of-the-box connectors to apps from Oracle Weblogic, IBM Websphere, Sharepoint.

PingAccess for AzureAD: Whether the acquiring or the acquired organization is using AzureAD to manage identities, PingAccess can be deployed to provide centrally managed access control to all on-premises applications at either organization.

AWS Deployment Automation: Deploy centrally managed access control to an acquired entity’s AWS instance in minutes with preintegrated reference architectures. You can take advantage of AWS auto-scaling for apps with unfamiliar demand patterns and customize access security in the most efficient manner for each resource.

Accenture MSP: If integration resources are temporarily tied up, or your long-term strategy is to utilize a managed service provider for identity and access management, Ping has partnered with Accenture’s Velocity Identity Program to provide high-scale, enterprise-grade identity services.
 

Figure 8: The Ping Identity Platform facilitates integration through out-of-the-box connectors with popular cloud-based services.

The potential economies of scale when healthcare entities combine can be significant. But payers, providers and pharmaceutical organizations are often cautious about rationalizing systems too quickly (or at all) for fear of disrupting business as usual.

Today, many healthcare organizations run multiple homegrown and legacy IAM systems for different groups of applications and those who use them. The hardware, licensing, administrative and productivity costs of this approach have magnified as the winds of M&A have swept across healthcare. To ensure smooth integration, the Ping Identity Platform is designed to help you maintain secure access to critical resources during IAM rationalization.
 

Figure 9: The capabilities of the Ping Identity Platform support IAM rationalization efforts, while ensuring uninterrupted access to critical resources.
 

Single Sign-on & Access Management

Patients, members and providers require uninterrupted access to critical health resources. Ping offers WAM integration kits and token translators to accelerate migration from legacy SSO and WAM providers. Best practice migration guides are also available to support your zero downtime transition from CA Siteminder (SSO), RSA Access Manager and Oracle Access Manager.

Multi-factor Authentication (MFA)

You can’t afford downtime and resulting “security exceptions” when rationalizing MFA-protected resources, particularly those containing e-PHI. Ping provides integration kits and adapters for legacy MFA solutions, including RSA SecurID and Symantec VIP, for a zero downtime rationalization or planned period of coexistence with cloud-based MFA solutions, like PingID.

Directory

Critical health apps rely on directories to authenticate users. So when directories go down, members, patients and providers lose access. PingDirectory can replace multiple directories without downtime through bidirectional data synchronization. You’re assured information is up to date before you take steps to deprecate legacy identity stores. PingDirectory is also equipped with a client SDK to mimic proprietary behaviors that apps may expect from the original directory. 

In the HIPAA Security Rule, the Department of Health and Human Services (HHS) provides implementation guidance around setting up “minimum necessary” access controls to prevent inappropriate usage of e-PHI. It recommends specific administrative, physical and technical safeguards to ensure the integrity of health data.

“A lack of access controls and regular review of audit logs helps hackers or malevolent insiders to cover their electronic tracks, making it difficult for covered entities and business associates to not only recover from breaches, but to prevent them before they happen.”

Robinsue Frohboese | Acting Director, HHS Office for Civil Rights

These recommendations guide healthcare organizations toward a comprehensive access control framework. Yet, the two largest fines issued for HIPAA violations in the history of the regulation—one for $5.55 million and the other for $5.5 million—were both the result of insufficient security.

The Ping Identity Platform can help you bridge the chasm between recommendation and implementation. Offering support for a number of administrative and technical precautions as illustrated in Figure 12, the Ping Identity Platform can help you comply with HIPAA and avoid costly fines.
 

Figure 12: How the Ping Identity Platform’s capabilities map to specific HIPAA compliance safeguards.

 

For a more complete overview of how the Ping Identity Platform supports HIPAA compliance and addresses the concerns of the healthcare CISO, CIO and CMIO, read the whitepaper: Seamless and Secure Healthcare Delivery with the Ping Identity Platform.

As a healthcare organization, you already know that achieving HIPAA compliance is only the first step in building a comprehensive access security framework. In fact, HIPAA purposely avoids prescribing specific technologies with an understanding that compliance is usually part of a larger defensive strategy. But building a strong framework becomes more challenging as the scope of resources and identity types under consideration expands and becomes more diverse.

As shown in Figure 13, the Ping Identity Platform provides solutions to address many of the challenges healthcare organizations face today.
 

Figure 13: The Ping Identity Platform solves for some of the biggest challenges facing healthcare organizations today.
 

Figure 14: How healthcare organizations are using the capabilities of the Ping Identity Platform to deliver improved experiences and strengthen security and privacy.