Health care: Duke University Health System’s new identity management solution helps doctors and patients

An incident such as that is rare, but certainly conceivable, especially when one considers the large number of applications most hospitals run. That is why Duke University Health System — comprised of Duke University Hospital, Durham Regional Hospital, and Duke Health Raleigh Hospital — has begun deploying IBM Tivoli Identity Manager.

"That's one of the largest complaints we get, about the difficulty of using passwords and having to get them reset," says Rafael Rodriguez, the healthcare system's associate CIO for academic and infrastructure service, adding that 40 percent of help desk calls are password related.

"These are busy people," he says. "They have to act quickly. The more impediments to that, the more errors they could make."

The identity management solution will enable the hospitals to manage passwords by letting users personally reset, change and synchronize them through a secure personal interface and without administrative intervention, a feature rare for many applications.

"There are a lot of home-grown applications that don't have that ability to reset the password," says Joe Anthony, program director of integrated identity management for IBM. "They're written by a programmer for a programmer. They don't always effectively take into account that an end-user is involved."

As an example, the Duke University Health System offers such an application — known as its clinical browser — that provides medical staff with patient information, such as vital signs, laboratory results, medication and allergy history.

The benefit of having all the information on one browser is obvious: "Doctors can get to it faster," says Rodriguez. "Some of these patient charts are really large and voluminous. This gathers together all the information about one patient."

"But, this creates a hurdle if they forget the password and have to call in and get it reset," he adds.

The identity solution also allows for employees to use the same password across multiple applications, Rodriguez says. This will lead to the hospital creating and enforcing better access policies, such as mandating that employees use more difficult-to-guess passwords. As it stands now, many staffers either use easily cracked passwords or write them down on pieces of paper —both security risks, he says.

The product also will contribute to better security because it serves as a centralized control mechanism, ensuring consistent policy across applications, according to IBM. And it will improve the ability to comply with regulations by producing reports on policy, events and access rights, enabling the healthcare system to quickly respond to audits.

The solution also allows IT administrators to easily implement and better manage new accounts, Rodriguez says.

Before choosing the Tivoli product, hospital IT administrators considered four other solutions, Rodriguez said. But, in the end, the hospital decided on IBM because Big Blue promised officials they were "committed to make the applications work with Tivoli," Rodriguez says.

Anthony says IBM has a strong working relationship with healthcare application service providers (ASPs) to integrate their products with Tivoli Identity Manager.

The solution will help Duke University Health System — which employs about 25,000 people, including 350 IT workers (about three are dedicated to security policies) — save money on administrative costs, while improving the end-user experience, Anthony says.

In addition, the product may retain and attract better doctors, thereby extending the Identity Manager's benefit to patients as well, Anthony predicts.

"Doctors aren't usually tied to a specific hospital," he says. "If they find one hospital is much harder to work at, they may lean toward doing their business at a hospital that invested a little more in it and made their lives easier."

DUKE HEALTH:
Investing for the future