WellSpan Health

The Approach

WellSpan chose Core Security’s Identity Governance & Administration solution to automate user provisioning, account disabling, self-service password management and access verification. WellSpan selected Core Security because of the company’s proven ability to streamline the user provisioning process, while providing the foundation for a strong identity management security policy and ensuring adherence to compliance requirements. Additionally, Core Security had the only solution that demonstrated it could easily integrate with the hundreds of healthcare-specific platforms currently deployed such as Cerner Millennium, Eclipsys, and GE Healthcare Centricity RIS-PACS. 

In advance of kicking off its automated user provisioning, WellSpan created a comprehensive Electronic Health Record (EHR) for every patient. While centralizing all patient data in one record improved efficiency for administrators and clinicians, WellSpan recognized that EHRs presented privacy and security challenges. WellSpan needed to ensure that access to health information was controlled without disrupting the clinical workflow, while at the same time ensuring that audit and compliance requirements are being met. Core Security’s Identity Governance & Administration solution demonstrated the ability to grant the appropriate user access to EHRs in the clinical systems, while doing it in compliance with government regulations for patient privacy.

Managing the Identity Crisis

A common challenge among healthcare organizations is to ensure that users have proper access to clinical applications and patient data so they can deliver effective patient care. Additionally, this access must be granted in compliance with government regulations requiring minimum necessary access and patient privacy. WellSpan’s challenge was no different – the need to provide its clinical workforce appropriate access to vital patient information through a variety of clinical systems to effectively and immediately provide patient care. 

To manage the identity crisis resulting from granting application access, resetting passwords and adhering to compliance requirements, WellSpan decided to implement an automated solution that would increase the reliability of user IDs and passwords, maintain the integrity of information that was becoming unmanageable, and support a critical mass of users and applications. 

Automated user provisioning and self-service password reset immediately improved WellSpan’s productivity, while still enabling WellSpan to maintain tight control over access to its clinical systems. Even while computer terminals we being shared by multiple employees, contractors, and additional third parties, WellSpan adhered to HIPAA regulations and its own security and compliance standards.

Moving From Manual to Automated Processes

In choosing an automated provisioning solution, WellSpan needed to address four main areas: supporting merger and acquisition activity and continued growth in clinical applications and IT users; streamlining access changes which were taking up to three months; demonstrating HIPAA and other regulatory compliance; and enabling care transformation by facilitating clinical application access control. 

With a deep penetration in the healthcare market and a history of successful customers in production, Core Security’s Identity Governance & Administration solution demonstrated the ability to streamline the user provisioning process while providing the foundation for enforcing security policies and ensuring adherence to compliance requirements. 

WellSpan’s starting point for implementation was to automate the provisioning of new users and disabling accounts of existing users to speed up the process and close security vulnerabilities. WellSpan wanted a direct feed from its Lawson HR system to automatically kick-off provisioning actions for its workforce.

From a provisioning and access control perspective, the most critical systems for automating the provisioning process were identified as GE Healthcare Centricity RIS-PACS, Cerner Millennium for EMR and Eclipsys for patient insurance and demographics. 

Prior to the implementation, all new user accounts were being provisioned to these systems manually; the human resources system would send an automatic notification, or paper access requests were faxed and entered into the help desk manually. It could take up to 20 minutes to an hour for one new user to be manually provisioned with the correct access. However, the bigger problem was making changes to account access settings, which could take anywhere from one week to three months. 

The same was found to be true in disabling user accounts–a task mainly handled by one person. If that person was out sick or had the day off, disable requests would have to wait to be completed, creating orphaned accounts problems where access was left activated for users no longer with the organization, exposing serious security risks. Now all provisioning of ‘basic access’ is automated directly from the Lawson HR system. A new user is automatically provisioned with basic access and the hiring manager then initiates additional access using other workflows.