CALL 1300 654 201 | GENUINE HID GOLD PARTNER
Toggle Nav
HID SAFE™ Provides Innovative Identity Management to a World-Class Medical Center
Case Study by HID Global
Our client is a pediatric medical center in the Midwest with one of the busiest pediatric emergency departments in the United States, and it performs the second largest number of surgical procedures at a children’s hospital in the country.
As the hub of the country’s economic activity and the key engine that drives the city’s economy, keeping this essential transportation system secure and running as efficiently as possible, 24/7, is imperative.
With a staff of 1,000 employees, the transportation system oversees a workforce of over 20,000 private contractors, tenants and third parties who sustain their operations throughout the region with over 1 million square feet leased to the operating and maintenance contractors, as well as to other tenants.
“Physical identity and access management (PIAM) deployments are increasing due to technology and product development, compliance mandates, a greater desire to manage alternative user populations such as on-premises visitors and contractors, and a sharp emphasis on timely and secure access.”
Gartner Research; Physical Identity and Access Management; Feb 2012
The Challenges
With diverse sets of identities (patients, visitors, medical staff, fellows, employees and contractors) with varying risk profiles on the hospital premises, the medical center’s key goal was to ensure that each identity gets the correct access assigned based on its role and risk profile. This ensures that only approved identities such as medical staff have access to high risk areas like operating rooms, while others do not.
To decrease risk and processing time, the medical center wanted the new solution to integrate with other internal hospital systems and incorporate hospital policies and governance standards. They needed a holistic tool for managing all types of identities; whether a visitor was a hospital employee or a family member of a patient, the medical center wanted a system that managed the entire physical access provisioning history of each visitor — the lifecycle of the identity from activation to deactivation.
Key requirements to manage physical identities at this medical center included:
- Integrate with the Human Resource Management System (HRMS) and leverage identities, roles and records managed by the Human Resources Department to provide consistency in provisioning and de-provisioning cardholders across physical security systems.
- Automate Physical Access Control System (PACS) cardholder provisioning, administration and reporting for new hires, terminations and change requests based on security policies.
- Reduce the manual interventions needed to provision these identities in existing PACS for Identity and Credential Management processes.
- Ensure compliance with HIPAA guidelines governing rightful use of identity credentials and badges to gain physical access to the medical center’s facilities and resources.
- Establish a framework to support disaster recovery, background checks, visitor management, building automation, IT security convergence, etc.
- Manage the entire visitor lifecycle, from the time the visitor is preregistered to the time they check-out.
The Solution
The medical center selected the HID SAFE for Healthcare solution to automate their existing manual processes. HID SAFE automates physical identities and access levels while enforcing complex policies and rules, resulting in faster processing times and better audit controls.
Key components of HID SAFE offered to the medical center include:
Identity Lifecycle Management
HID SAFE enabled the medical center to standardize, centralize and automate onboarding for all identity types requiring physical access to its facilities, creating a single version of truth across the medical center’s entire physical infrastructure. HID SAFE integrated with the medical center’s PeopleSoft HRMS to extract key identity information and on-board these identities in HID SAFE. This integration between HID SAFE and PeopleSoft provides the foundation for bidirectional data exchange, so that any change made in the HR system is automatically reflected in the identity and default access levels. If an identity were to be deactivated in the HR system, the access levels of the identity would be removed automatically, thus completing the entire lifecycle.
Attribute-Based Access Assignment
HID SAFE uses attributes of identities (e.g. location, department and identity type) delivered from the medical center’s HRMS to automatically determine the base access assignments a cardholder should have. Upon the production of a card, HID SAFE automatically provisions these accesses to the PACS using the existing PACS Groups (access levels) and reader configurations.
Comprehensive Reporting
HID SAFE provides the medical center with a robust and full-featured reporting capability that can support workflow-embedded, scheduled, and ad-hoc reporting of identity and physical access events and activity. HID SAFE provides key reports and dashboards for on-boarded identities, their access details and badging activities across multiple views; this allows the medical center to make appropriate operational decisions, prevent possible threats and be HIPAA compliant. Administrators can display this information on a user configurable dashboard to graphically display the information in an ‘ata-glance’ view as well as configure reports to be sent to SAFE users based on events/triggers or scheduling defined in the policy engine.
Visitor Management
HID SAFE provided the hospital with an intelligent visitor management solution. The solution enables patients to register their approved and unallowed visitors, screens the visitors against watch lists with proper background vetting, allows the visitors to check-in based on the visitation policy of the patient (private encounter, pre-approved visitor list), and securely provisions identities into diverse Physical Access Control Systems (PACS).
Attribute-Based Access Assignment
HID SAFE uses attributes of identities (e.g. location, department and identity type) delivered from the medical center’s HRMS to automatically determine the base access assignments a cardholder should have. Upon the production of a card, HID SAFE automatically provisions these accesses to the PACS using the existing PACS Groups (access levels) and reader configurations.
End-to-End Badge Management
HID SAFE helps issue secure smart card credentials to ensure secure access to the medical center’s facilities and thwart the possibility of counterfeiting. Using the badging capabilities of HID SAFE, users can create multiple badge designs based on the identity type. Similar to attribute-based access provisioning, HID SAFE allows the automatic association, issuance and printing of a pre-determined medical center badge template for an identity based on the attribute(s) of that identity. HID SAFE also allows the medical center to manage badge policies like setting up a badge expiry date and automating the renewal cycle when required.
The Outcome
HID SAFE has replaced the manual processes associated with personnel on/off-boarding, card issuance, access assignments and provisioning in PACS at the medical center so that new personnel can now be on-boarded and operational in minutes rather than days or weeks. HID SAFE ensures up to a 90% reduction in manual interventions for the processes related to identity management, which saves the medical center a huge sum in annual operation costs.
The medical center has received the following overall benefits utilizing HID SAFE:
- Safer Premises: Through HID SAFE’s centralized administration of the entire access management process, the medical center’s security team has a comprehensive unified view of their entire physical operation. This prevents unwarranted identities from accessing the premises of the facility.
- Enhanced Operational Efficiencies: With the automation of previously manual tasks and system operations, HID SAFE provides approval for identity access requests within minutes, improving operational efficiencies.
- Positive Impact on Patient and Visitor Experience: In addition to enabling patients and families to create personalized visitation lists and policies, visitor information is readily available to front desk personnel in advance. This has reduced the time needed for visitor check-in and badge issuance and positively impacted the patient and visitor experience.
- Substantial Reduction in Operation Costs: By automating access management processes with HID SAFE, the medical center realized immediate operating cost reductions.
- Superior HIPAA Compliance: HID SAFE’s policy-based system provides the medical center with effective, audit-ready and automated compliance with federal laws, regulations, standards and governance relevant to physical security identity and access management.