Case Study: Applying Authentication Technologies as Part of a HIPAA Compliance Strategy

Agenda Why Focus on Authentication? HIPAA Security Requirements Selecting Authentication Technologies Framework for Assessing Authentication Technologies – Examples Summary Case Study: McKesson

Why Focus on Authentication? Foundation for other critical services Growing need for stronger authentication –Expanding access to applications –User base –SSO HIPAA Business policy: liability, assurance for transactions Relationships between people, groups, and organizations Applications and services: access control and authorization Relationships between identities and information Presentation / Personalization: what the user sees Defining relationships through quality of experience Authenticated Identity (user, device, application, group, organization) Source of graphic: Burton Group, “Enterprise Identity Management”, October 2002

HIPAA Security Requirements General requirements –Ensure the confidentiality, integrity, and availability of all electronic protected health information –Protect against any reasonably anticipated threats or hazards and uses or disclosures not permitted under privacy regulations Flexible Approach –Use security measures that reasonably and appropriately implement the standards based on risk analysis –Consider organizational size, complexity, existing infrastructure, and capabilities; as well as costs –Technology-neutral

HIPAA Security Requirements Technical Safeguards –Authentication, access control, data integrity, transmission security, audit controls Administrative safeguards –Policies and procedures, risk analysis, workforce training, disaster recovery, evaluation, business associate contracts Physical Safeguards –Controlling access to facilities, workstation security, device and media controls

HIPAA Security Requirements “Standard: Person or entity authentication. Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.”* *45 CFR Part HIPAA Security Standards: Technical Safeguards

HIPAA Security Requirements Based on risk analysis, select appropriate and reasonable method –Look at security best practices in the industry For some applications, best practices require more than passwords –E.g. “Remote access requires two-factor authentication.”* For others, current best practices say passwords okay –E.g. For patient or member access to web sites** For many applications, will depend on organization Best practices evolving *HIPAA Security: the latest and best practices, Tom Walsh, CISSP, HIMSS, 2003 **Gartner

Selecting Authentication Technology Levels of authentication –Single factor versus multi-factor Diverse environments –On-site clinical versus on-site office –Web access for patients/members –Remote and web access for professionals Selection criteria –Strategic fit in corporate/system –Strategic fit for users –Total cost of ownership Passwords

Framework for Assessing Authentication Technologies: Authentication Scorecard: Total Cost of Ownership Acquisition Deployment Operating Total Cost of Ownership Acquisition Deployment Operating Strategic Fit (Corporate / System) Relative Security Interoperability / Back-End Integration Robustness / Scale Future Flexibility Strategic Fit (Corporate / System) Relative Security Interoperability / Back-End Integration Robustness / Scale Future Flexibility Strategic Fit (Users) Convenience / ease of use Portability Multi-purpose Strategic Fit (Users) Convenience / ease of use Portability Multi-purpose Apply a score of 1-10 to each of the ten attributes.

Example: User ID/Password

Example: Hardware Tokens

Example: Digital Certificates

Example: Smart Cards

Summary Selection of authentication technology depends on –Organization –Application –Risk analysis –Best practices Case study –Implementing authentication for SSO initiative Meet HIPAA and other requirements

Laura Robinson Healthcare Industry Analyst RSA Security, Inc.