Connected Thinking
unread,Nov 22, 2008, 3:46:15 PM11/22/08Sign in to reply to author
Sign in to forward
You do not have permission to delete messages in this group
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to EMR Data Use Workshop
(i) Does your organization have privacy and security policies?
Yes
Identity management systems that are integrated with smart card-based
authentication devices are an ideal way to tackle several of the
challenges related to network and data security services required by
healthcare organizations. For IT administrators, identity management
systems provide meta-directory capabilities for users’ identity
credentials. They support a single view of their identities throughout
the organization and maintain the consistency of this view across all
connected systems and applications. These solutions can be deployed
to protect identity credentials and access to networks, applications
and data across multiple business processes. They also make it easier
to enroll and update user profiles, manage PKI (Public Key
Infrastructure) certificates, and implement role based security
policies. This versatility enables IT administrators to manage user
accounts, protect network and application access, issue certificates
with a centralized Certificate Authority, and audit user activities
throughout the organization. Smart card devices for end-users can
significantly reduce the cost of deploying and managing PKI systems.
(ii) How well do these work?
a) Windows and application logon from single-user workstation or
laptop
Clinicians can use their smart card device to securely log on to
workstations and laptops running Windows operating systems and
automatically to applications after system logon. This enhances
security by ensuring that only the authorized user can access the
system and authorized applications regardless of location. For logon
to Windows Vista, the device is connected and the clinician presses
CTRL-ALT-DEL to access the logon window. The smart logon credential is
selected and the correct PIN is entered for secure access. Using
password management applications, the system logon process can also be
coupled with application login to save time and avoid the need for
multiple user IDs and passwords. In this scenario, a single smart card
logon can be used for direct access to the PC and patient care
applications.
a) Secure access from a shared kiosk with automatic logoff
After a workstation is idle for a predetermined length of time, the
session can be securely locked; users can also lock their sessions.
Unlike a standard Windows computer lock where only the same user or an
administrator can unlock the session, the smart card solution can be
used with Single Sign-on products to allow any user to unlock the
session and use their smart card device to log on the shared
workstation immediately. If the same user unlocks the workstation
before the session timeout, the user will continue where they left
off. If a new user unlocks the workstation, the previous user’s
session is shut down and a new session is instantiated in a matter of
seconds. Clinicians often need to continue the work started by a
colleague with the same workstation and application that was
previously in use. Using a smart card-based solution integrated with a
password management application, it is possible to lock, but not
close, applications to subsequently enable fast and secure access. To
facilitate this level of seamless access, applications can be
designated not to close after a user logs off or locks the
workstation: they enter a secure mode instead. For example, if a nurse
updates patient information and locks the workstation or logs off, the
application securely locks. Later, a doctor who needs immediate access
to that patient’s record logs on with a smart card device and the
application unlocks without reloading to provide immediate access.
b) Secure VPN access from a laptop needing remote access
Healthcare organizations can use smart card devices with VPN client
applications for certificate-based authentication to enhance the
security of their remote access systems. This also increases
productivity by enabling healthcare employees to work remotely and
respond to patients as needed. Certificate-based authentication can be
selected using the VPN client interface and the certificate with the
desired Certificate DN (Distinguished Name), validity date range, and
issuing authority is selected. When the smart card device is used, the
VPN client application displays the PIN dialogue box, the correct PIN
is entered and the secure VPN connection is established.
c) E-mail encryption
E-Mail encryption protects the message content so only the sender and
the intended recipients can read it, strengthening the security of
patient information and other sensitive information for secure
communication and collaboration among clinicians. For example,
treatment options or comments about a medical journal article can be
exchanged in confidence between the sender and recipients. Messages
are encrypted using the public key of the recipient’s encryption
certificate. When the messages are received, they are then deciphered
using the private key from the recipient’s encryption certificate
which is stored on the smart card device.
d) Digital signature for electronic health records
In Microsoft Outlook messages and Office (Word, Excel and PowerPoint)
documents, digital signatures are used to authenticate the identity of
the person signing the document. They can be used to sign electronic
health records and are considered to be legally valid. The signature
is created using the digital certificate stored on the smart card
device and is validated by comparing it with a trusted Certificate
Authority’s database to confirm its legitimacy and validity. Microsoft
applications will confirm the digital signature by displaying a
message that the signature is OK. Digital signatures also are used to
verify the identity of the e-mail message sender and the signer of a
document. This ensures that the original message or document arrives
unchanged. Applications can also digitally encrypt and sign messages
and documents.
b) What are the crucial elements that make for success or failure
here?
Identity management systems and smart card-based authentication
devices provide several tangible benefits for healthcare
organizations, including: a) Highly favorable and rapid ROI due to
faster access to network resources, reduced password support costs,
streamlined identity management, and risk reduction b) Enhanced
security for logon, remote access, patient information and sensitive
data c) Optimization of patient throughput and clinician productivity
with fast secure access and services such as digital signature and
single sign-on to workstations and applications d) More convenient and
secure PKI systems – credentials stored on the smart card device are
more portable and safer than those stored on a PC f) Improved
utilization of IT resources with integrated identity management
services, reduced password support requirements, and streamlined
integration with third-party devices and services g) Efficient and
streamlined process for any quality control or compliance
For doctors and clinicians, these solutions offer fast, secure and
easy-to-use access to workstations, applications, and patient
information regardless of care location. With convenient access to the
IT resources they need, healthcare workers are more productive and
have more time to spend with patients. In addition, security-enhanced
communications facilitate collaboration among healthcare organizations
and caregivers who are dedicated to providing the highest levels of
patient care. Hence success outweighs failure.
Titus Ngeno
Software Architect
Cerner/Perceptive Corp