Security

Review: RSA ID Plus Gives Healthcare Identity Security a Stronger Pulse

Flexible authentication, adaptive security controls and resilient access help providers protect sensitive systems without creating unnecessary friction.

John Breeden II

John Breeden II is an award-winning reviewer and public speaker with 20 years of experience covering technology.

Healthcare organizations face an identity conundrum. Clinicians, administrators, contractors and support staff all need reliable access to applications and patient information, but every additional identity and authentication point creates another opportunity for attackers. The challenge? How to protect those accounts without slowing down the people who need to get into critical systems quickly.

RSA ID Plus is designed to address both sides of that problem. The identity and access management platform combines multifactor and password-free authentication, single sign-on, adaptive access, risk intelligence and support for cloud, hybrid and on-premises environments. For healthcare organizations, that combination can help strengthen identity security while reducing unnecessary friction for legitimate users.

Click on the banner below to learn more about how IT leaders are tackling newer cyber risks.

prr-q226-securityreport-static-clickhere-desktop

prr-q226-securityreport-static-clickhere-mobile

RSA Plus ID Offers Plenty of Authentication Options

In my testing, one of the first things that stood out was the breadth of authentication options. ID Plus supports FIDO2 and passkeys, mobile push notifications, biometrics, one-time passwords, QR codes, hardware tokens and third-party authenticators. That flexibility matters in healthcare because not every user works the same way. A clinician moving between care areas may have very different access needs from a billing employee at a workstation or an administrator connecting remotely.

Password-free authentication can also reduce the risks associated with traditional credentials. Instead of relying on a password that can be phished, reused or shared, organizations can use stronger methods such as FIDO2 credentials or biometrics. In evaluating the platform, the ability to offer several authentication methods without forcing every user into one workflow seemed especially valuable.

Adaptive Access Adds Context to Authentication

Strong authentication is important, but not every login carries the same level of risk. RSA ID Plus can apply contextual and adaptive access controls that consider the circumstances surrounding an authentication request.

RSA Risk AI expands on that approach by assessing behavioral characteristics and other contextual signals to determine risk in real time. That can help an organization distinguish between a routine login and one that may require additional scrutiny. RSA Mobile Lock can also incorporate the security state of both managed and personal devices into authentication decisions.

In testing, this layered approach made more sense than treating every authentication request identically. Healthcare environments are highly dynamic, with employees moving among departments, facilities and devices. The ability to strengthen authentication when risk increases while keeping routine access relatively streamlined can help balance security with usability.

Single sign-on adds another layer of convenience. Users can access authorized applications through a centralized experience rather than maintaining separate credentials for every system. For healthcare IT teams, that can reduce password fatigue while giving administrators a more consistent way to control access.

Resilience Matters When Access Is Critical

Identity security also has to remain available. Providers cannot simply stop working because an authentication service or internet connection goes down.

RSA ID Plus supports cloud, hybrid and on-premises environments, including a hybrid authentication failover capability designed to maintain authentication when the RSA cloud service cannot be reached. When failover is activated, users can continue authenticating to protected on-premises systems using one-time passwords.

That kind of resilience is particularly relevant in healthcare, where access interruptions can affect electronic health records, scheduling, communications and other systems tied closely to patient care. While I tested the platform, simulating an active, dynamic healthcare environment, it became very clear that the ability to support modern cloud applications while also retaining options for legacy and on-premises resources was one of the strongest architectural advantages of ID Plus.

The platform also integrates with common identity infrastructure, including Active Directory, LDAP and Microsoft Entra ID, along with standards such as SAML 2.0, OIDC and RADIUS. That breadth should help healthcare organizations add stronger identity controls without having to replace all existing systems at once.

Ultimately, RSA ID Plus succeeds by treating identity security as more than a password or an MFA prompt. Its combination of flexible authentication, adaptive risk controls, single sign-on and hybrid resilience can help healthcare organizations protect sensitive systems while keeping access practical for clinicians and staff. In an environment where both security and availability matter, that balance is exactly what a modern identity platform should provide.

SPECIFICATIONS

PRODUCT TYPE: IAM platform
SUPPORTED ENVIRONMENTS: Cloud, hybrid and on-premises
AUTHENTICATION METHODS: FIDO2 and passkeys, mobile push, biometrics, one-time passwords, QR codes, hardware tokens and third-party authenticators
ACCESS CONTROLS: Single sign-on, contextual access and adaptive access
DIRECTORY SUPPORT: RSA ID Plus Cloud Directory, Active Directory/LDAP, Microsoft Entra ID and custom user stores
INTEGRATIONS: SAML 2.0, OIDC, RADIUS, Windows, macOS and Linux

Why Healthcare Identity Security Can’t Stop at MFA

Multifactor authentication has become an important defense against stolen passwords, but healthcare identity security cannot end with a second login factor. Modern healthcare environments span cloud applications, on-premises systems, remote users, shared workflows and an expanding collection of connected devices. Protecting access across all of them requires more context and control.

The first step is reducing dependence on passwords themselves. Password-free methods such as FIDO2 credentials, biometrics and device-based authentication can make phishing and credential reuse less effective while also reducing the number of passwords users have to remember.

Healthcare organizations also need to understand the circumstances surrounding an access request. Adaptive controls can consider user behavior, device condition and other contextual signals before deciding whether normal access should continue or stronger verification is warranted. That approach helps security teams focus additional friction where risk is higher instead of treating every login the same way.

Resilience is another consideration. If authentication depends entirely on a cloud service, an outage can create an availability problem even when clinical and administrative systems are otherwise functioning. Hybrid authentication options can provide another path to protected on-premises resources when cloud connectivity is disrupted.

Finally, access management needs to extend beyond authentication. Single sign-on, self-service credential management and identity governance capabilities can make it easier to give users appropriate access while reducing repetitive work for IT teams.

MFA remains an essential part of healthcare cybersecurity, but it works best as one layer of a larger identity strategy. Platforms such as RSA ID Plus combine authentication with access controls, risk intelligence and resilient identity services, helping organizations protect sensitive resources without making legitimate users fight through unnecessary barriers.