Common Identity Management Challenges in Healthcare
Having the right type of data about each employee’s role can often be a challenge for healthcare organizations. For example, all roles, whether they’re clinicians or administrative personnel, flow through an HR information system. The data from that platform then flows into an identity or automated provisioning tool. If the roles don’t define what each role requires in terms of data or network access, then it can be hard to find the right set of entitlements for provisioning.
As a result, someone might take a copy-and-paste approach to provisioning. They might model a new doctor’s access on that of a doctor in the same department without realizing that they have different data needs. Many healthcare organizations need help getting to that level of granularity. It can also be a challenge to ensure the organization is using an authoritative source of data to make those identity management decisions.
On the deprovisioning side, the process isn’t always straightforward. If a doctor leaves, it’s possible an organization would prefer to disable their access but maintain the identity in case the doctor comes back to do work as a contractor or is being seen as a patient. Organizations need to create governance that helps IT identify when an employee should be deprovisioned versus simply changing their access, or to determine how long that identity should stay in the system.
A common mistake we see is that organizations prefer to handle their deprovisioning in batches, meaning that an employee could still have access for a few weeks after they’ve left or after they have been terminated. This creates unnecessary risk, especially if that account isn’t being monitored.
EXPLORE: These are the top three reasons to modernize your IAM program.
How Do IAM Tools Help IT Teams Overcome Provisioning Challenges?
A good IAM platform can handle the entire identity lifecycle management. It should give HR the ability to provision users automatically when they’re onboarded. All of those user creation tasks can be completed automatically, including giving birthright access to a specific set of applications and creating additional role-based access.
Centralized management is another big benefit of using an IAM platform. Some organizations have gone through a lot of merger and acquisition activity, leaving them with disparate domains and multiple sources of truth. A good IAM system can bring all of that information together and create one source of truth that allows the organization to be flexible when undergoing cloud migration or integrating Software as a Service applications.
It's also important that healthcare organizations have a cohesive strategy around their end-user service catalog as it relates to both identity provisioning and access requests because not everything happens on birthright. Birthright refers to a new employee onboarding and getting an active directory account, email address and anything else needed for their role, but that’s where it stops. From there, the employee has to ask for access.
Joining access and device provisioning is also a useful best practice. When those two are disjointed, then the user experience can be poor for both the new employee and the staff handling the onboarding process.
