Healthcare’s Top Five Identity and Security Challenges

As they pursue their goal of providing top-quality patient care, Saviynt helps healthcare organizations keep their data secure.

These days, there’s a lot of pressure on healthcare organizations. The pandemic has brought about profound changes in patient care in a short amount of time. Most notably, the rapid acceleration of digital transformation with patient data moving to the cloud through the rise of electronic health records (EHRs), expansion of telehealth services, the increase in Internet of Medical Things (IoMT) identities, and reliance on temporary staff brought on by the enormous strain of recent events.

This increasing digitization has brought much-needed efficiencies in record keeping and patient care, but the proliferation of personal data online has also attracted the attention of cyber attackers. Patient data, rich in protected health information (PHI), can bring top dollar on the dark web. So there is a lot riding on securing a healthcare organization’s identity and access management (IAM) practices. 

Here are the top five challenges to identity and security that healthcare companies face:

1. The Growing Digitization of Healthcare

EHR systems, such as EPIC and Cerner, consolidate information from a variety of sources for different users to utilize for a variety of important functions. These can include processing claims and generating invoices, creating and updating digital charts, reporting, managing tasks, and more. The information contained in EHR systems is highly sensitive, yet many IAM solutions lack fine-grained provisioning and access with EHR systems. Not only can this impact patient care, but the data is also vulnerable to attack. 

In addition, mobile apps, wearables, and telehealth along with the proliferation of machine identities from medical devices (ventilators, insulin pumps, etc.) have all contributed to increasing the challenge of governing and managing identities. These systems often have their own roles and access controls, complicating an already tangled matrix of technologies and users. 

Healthcare organizations need a holistic identity governance system that unifies identity across all environments and streamlines identity and access management. The system needs to easily manage all identities, human and machine, in complex and multi-cloud environments. They need an intuitive solution that reduces access delays, secures patient and organization data, and ensures compliance.

2. Widespread Use of Contractors & Temporary Personnel

Healthcare providers are bringing in large numbers of temporary staff (e.g. traveling nurses, visiting physicians, etc.) to address staff shortages. According to a recent AMN study, 96% of providers used temporary staff in the last year. This results in an increase in joiner-mover-leaver events that can impact patient care delivery and increase risk if not handled properly. Further complicating the situation, clinicians may be moving between departments or roles and require different access. 

The use of third-party vendors is also common. A recent SecureLink report found that “44% of healthcare and pharmaceutical organizations have experienced a breach caused by a third party in the past twelve months.” Most IGA solutions can’t address the unique needs of non-employees resources, forcing the identity team to create hybrid solutions with a combination of HR systems, manual processes, and a lot of disjointed information. 

Healthcare organizations need a solution that can consolidate disparate identities by combining them into a single “identity for life” for each user. This would simplify management regardless of changes in user roles and functions, even on a temporary basis.

3. Legacy Systems that Impede Modernization

While many of the technologies used in the treatment of patients are highly advanced, healthcare organizations are cost-conscious and traditionally, and rightly, put an emphasis on spending money on salaries for patient-facing staff. This has meant that many support systems have not been upgraded in a timely manner, leading to gaps in coverage, along with increased management costs, excessive administrative overhead, and operational inefficiencies that burden healthcare staff. Many provider organizations have historically done their own in-house application development for IAM and now have legacy systems that lack modern capabilities, leaving them vulnerable to attack. Or organizations have been using on-premises IAM/IGA solutions, which have the same challenges as homegrown ones.

Because of the nature of identities in healthcare, these legacy systems can be difficult to move away from, however, legacy platforms are increasingly unable and unequipped to protect healthcare accounts as their security features are increasingly out of date. 

They have trouble integrating with EHR systems and cannot provide the granular controls needed for today’s digital environments. Enterprises must secure all applications and access, not just that of a couple of high-profile, business-critical systems, such as financials or ERP platforms. To reduce the attack surface, all on-prem, hybrid, and cloud systems must be onboarded to enable governance and end-to-end provisioning. Lack of visibility across identity and access can create additional risk and make governance complicated and time-consuming.

4. Stringent Regulations

As one of the most heavily regulated industries, healthcare organizations need to ensure compliance with regulations, such as HIPAA, HITECH, GDPR, and PCI. Demonstrating compliance can be a complicated prospect when dealing with legacy and custom solutions. Legacy systems require information to be pulled from each disparate system during the audit process to provide the proper reporting to auditors or boards of directors and prove compliance. Compiling these reports can be tedious and time-consuming, taking administrators away from important projects or daily activities. 

Healthcare organizations need a solution that provides centralized reporting and continuous compliance. Centralized reporting capabilities reduce the time needed to create and distribute reports to confirm compliance or findings remediation. Continuous compliance, accomplished through monitoring and remediation, makes it possible to maintain compliance throughout the year, not just in the weeks before an audit.

5. Lack of Comprehensive Identity Governance, Access, and Administration

A quick glance at the IAM environment in most healthcare organizations reveals the need for a comprehensive solution to manage identity governance, access, and administration.

Such organizations are characterized by a diverse assortment of: 

• Environments–cloud, multi-cloud, hybrid and on-premises 
• IAM solutions–many of them developed in house, each with its own access controls
• Personnel needing access–physicians, billing departments, nurses, specialists, short term contractors, third-party vendors, and others
• Work locations–on-site, mobile, remote

Built on Saviynt’s industry-leading Enterprise Identity Cloud (EIC) architecture, Saviynt Healthcare Identity Cloud addresses the unique challenges healthcare providers face managing identities. The platform allows organizations to modernize their identity programs and remove barriers to patient care delivery by providing frictionless user access, simplified administration, and access controls within a single converged framework that centralizes human and machine identity governance, privileged access management, third party access, and other critical identity functions.