Identity Management Enables Care Anywhere

Healthcare organizations are increasingly delivering care beyond their physical walls, requiring secure access to patient records from any location. Identity management supports health systems’ ability to provide care anywhere by creating a unified security framework for clinicians and nurses.

According to the National Institute of Standards and Technology, identity management is “establishing and managing the roles and access privileges of individual network users.” This process includes how staff are onboarded into various systems, what systems and data they have access to, and what the process is when someone leaves or changes roles, explains Sandeep Kumbhat, vice president and global field CTO at Okta.

“Identity is the foundational security control that makes safe, connected care possible,” he says. Kumbhat describes this shift in care delivery as impacting the “perimeter” of the “traditional security model,” where any device or user connected inside a network (e.g., on-premises) has been automatically deemed safe. In an increasingly digital world, where clinicians are traveling to multiple locations or working from their own homes for telehealth appointments, what constitutes a “safe” user or device must pivot to outside the hospital’s physical location. “Identity becomes the new perimeter,” says Kumbhat. “It doesn’t matter if a physician is accessing records from the ICU or their home office: What matters is that their identity is verified and their access is governed by consistent policies across every touchpoint,” he adds.

Operational Efficiency and Protection

Health systems often operate with multiple, disparate systems that require staff to remember various usernames and passwords. Organizations with a focus on security and modernization have adopted a unified approach to access. Relying on an identity management system, staff use a single, secure login to gain entry to the network — whether remotely or on campus — and access to whatever applications and information they need, explains Kumbhat.

Behind the scenes, the hospital’s IT team manages automations tied to the organization’s directory and HR systems, ensuring that only employed staff can log in to the network. When these systems communicate, a traveling nurse going from campus to campus doesn’t have to log in to multiple networks, and a physician on their first day already has the access they need to provide care.

At the University of Pittsburgh Medical Center, identity management has been a major focus for decades. The system is connected to Active Directory, which ensures that onboarding and offboarding are done seamlessly and that access depends on privilege level and role. Layered onto their identity management process is multifactor authentication. “Patients trust us with their most sensitive information, and we have a responsibility to protect it,” says Ed McCallister, senior vice president and CIO at UPMC.

This setup allows clinicians to access the network regardless of where care is delivered. “Identity management enables flexibility to ensure users can securely and consistently access the systems they need, regardless of where care is delivered,” says McCallister. “Healthcare today is not confined to a single location, and neither are the people delivering care.”

Building and maintaining an effective identity management program takes time, coordination across teams and consistent adherence to standards and processes, adds McCallister. “Without that discipline, organizations may implement solutions but never fully realize their value.” This value extends into two areas: improved user experience as staff more efficiently and easily gain access to the systems they need, when they need it, and a strengthened cybersecurity foundation for the organization.

A particularly vulnerable access point in healthcare is compromised credentials. “Once access is gained, it can impact system availability and, ultimately, our ability to deliver care.” In this worse-case scenario, when a health system also requires multifactor authentication, sensitive information remains protected, says Kumbhat. By removing unauthorized access and limiting permissions for staff to their roles and responsibilities, IT leaders can bolster security measures to help prevent potential breaches.

Modernization and Future Outlook

IT leaders often come into their role with the looming task of connecting various antiquated and siloed systems into something cohesive and functional; this may be due to outdated legacy systems or as a result of a merger or acquisition. Whatever the reason, Kumbhat says, leaders should modernize one thing at a time, starting with business applications and getting single sign-on and multifactor authentication established. The next phase includes automating permissions and looking at clinical workflows.

The steps taken to modernize an identity management system are also steps toward modernizing the overall health system, adds Kumbhat, including “interoperability, better digital experiences for patients and AI-powered workflows that all require a trustworthy identity layer to function securely.” The health systems that make the most progress treat identity as an ongoing program rather than a one-time project, says Kumbhat.

Healthcare innovation needs a strong data base to support these complex digital transformations and secure environments. Implementing robust identity protocols ensures that patient data remains confidential and accessible only to authorized personnel. This approach is essential for maintaining trust and safety in modern medical environments.

Modernizing access control also addresses the broader trend of digital health integration. [1]Healthcare innovation needs strong data base to support these complex digital transformations and secure environments. Implementing robust identity protocols ensures that patient data remains confidential and accessible only to authorized personnel. This approach is essential for maintaining trust and safety in modern medical environments.

IT leaders should prioritize establishing these foundational security layers before expanding into clinical workflows. By securing the entry point, organizations can safely integrate new technologies. This methodical approach prevents security vulnerabilities from compromising sensitive patient information.

UPMC’s strategy demonstrates the practical benefits of this discipline. The organization uses a single, secure login to manage access across its vast network. This efficiency allows staff to focus on patient care rather than managing passwords. The result is a streamlined operation that protects critical health data.

Security protocols are vital for protecting against credential theft. Without these measures, a compromised account could disrupt system availability and hinder care delivery. Kumbhat emphasizes that multifactor authentication adds a necessary layer of defense against unauthorized entry.

Future health systems will rely heavily on these identity layers to function securely. As technology evolves, so too must the strategies used to protect patient information. Continuous improvement and adaptation are key to maintaining a secure healthcare environment.