Evidian

HIPAA Security Rule
Compliance with
Evidian IAM

Evidian Identity and Access Management Suite can help a Covered Entity1
achieve compliance with the implementation specifications contained in
the HIPAA Security Rule.
As explained in Paragraph 164.306.d, some implementation specifications
are “required”, which means that they must be implemented as specified.
Some implementation specifications are “addressable”, which means that
the Covered Entity must determine how best to implement them, taking
into account its own environment and risk estimates.

45 CFR Paragraphs

Definitions/Requirements

164.306.a

Covered Entities must do the following:

164.306.a.1

Ensure the confidentiality, integrity, andavailability of all electronic protected healthinformation the covered entity creates,
receives, maintains, or transmits.

IAM Suite provides a range of features to protect PHI. Suchprotection can take effect during access to applications,through identity verification and role-based access granting.

164.306.a.2

Protect against any reasonably anticipatedthreats or hazards to the security or integrityof such information.

Protection against anticipated threats relating to access
control can be easily integrated into the CE’s security accesspolicy using the IAM Suite tools.

164.306.a.3

Protect against any reasonable uses ordisclosures of such information that are notpermitted or required [for maintenance].

Identity Governance and Administration (IGA) makes it
possible to restrict PHI access to users on a need-to-knowbasis, using a role-based management approach.

Ensure compliance with this subpart by its
workforce.

IAM Suite helps ensure compliance by providing end-users
with an unobtrusive but mandatory interface. Enterprise
Access Management (EAM) clients work on the client
workstations and do not require any additional software
when accessing secured web resources.

164.306.a.4

Evidian IAM Suite contribution

Moreover, IAM Suite provides demonstrable added value tousers through its SSO features, thus aiding acceptance by
the workforce.

1. Covered Entity: any healthcare provider, health plan or healthcare clearinghouse2

45 CFRParagraphs
164.308.a.1.i

164.308.a.1.ii.B

164.308.a.1.ii.D

164.308.a.3.i

Definitions/
Requirements

Required/
Addressable

IAM Suite featureStandard: Security management process.
Implement policies and procedures to prevent, detect,contain, and correct security violations.
Risk management. Implement
security measures sufficient to
reduce risks and vulnerabilities
to a reasonable and appropriate
level to comply with Sec.
164.306(a).

Information system activity
review. Implement procedures
to regularly review records ofinformation system activity, suchas audit logs, access reports,and security incident tracking
reports.

RequiredSee § 164.306.a.3.

IAM Suite stores and makes available a quantity of audit data
regarding security-related activity, for instance:
User-related data such as access to individual applications,
successful or failed access, security incidents etc.
Required◄•	 Administrator-related data such as granting of rights,
creation and deletion of user and resources, groups etc.
• Centralized data on consultation history for all protected
web resources.
• Access certification is an audit and governance process
aimed to ensure that user’s access rights are compliant
with security policies.

Standard: Workforce security.
Implement policies and procedures to ensure that all members of its workforce have appropriate accessto electronic protected health information (…) and to prevent those workforce members who do not haveaccess (…) from obtaining access to electronic protected health information.

164.308.a.3.ii.A

Authorization and/or
supervision. Implement
procedures for the authorization
and/or supervision of workforce
members who work withelectronic protected healthinformation or in locations
where it might be accessed.

164.308.a.3.ii.B

Workforce clearance
procedure. Implement
procedures to determine thatthe access of a workforce
member to electronic
protected health information isappropriate.

164.308.a.3.ii.C

Termination procedures.
Implement procedures forterminating access to electronic
protected health information
when the employment of aworkforce member ends or
as required by determinations
made as specified in paragraph(a)(3)(ii)(B) of this section.

Addressable

Access to the features of the administration user interface isitself restricted according to roles. This means that the rangeof administration actions that administrators may perform
is entirely configurable, and the authorization procedures
can be implemented with ease. The Web Portal Home pageis generated dynamically depending on your rights. It only
displays the list of actions (requests and/or information
consultation) that you can execute by yourself. As well, theresponsibility of user access granting can be delegated toadministrators in remote locations

Addressable

Using IGA provisioning, each workforce member can be
assigned the appropriate access rights to resources (onpremise or cloud) where PHI is located. This is the case not
only for workforce members, but for all other types of users
as well – internal or external.

Addressable

IGA solution makes access termination easy and quick. Oncea user’s employment ends, the user is simply removed fromthe list of active users; IGA handles automatically all accessrights deactivation/removals to individual resources.
Employee termination can concern remote entities such asaffiliates of the CE. In that case, termination can be handled
locally by a delegated administrator whose administrative
rights are tailored according to the CE’s internal procedures.

HIPAA Security Rule Compliance with Evidian IAM

3

45 CFRParagraphs

164.308.a.4.i

4Definitions/
Requirements

Required/
Addressable

IAM Suite featureStandard: Information access management.
Implement policies and procedures for authorizing access to electronic protected health information thatare consistent with the applicable requirements of subpart E of this part.

164.308.a.4.ii.A

Isolating healthcare
clearinghouse functions. If ahealthcare clearinghouse ispart of a larger organization, theclearinghouse must implement
policies and proceduresthat protect the electronic
protected health informationof the clearinghouse fromunauthorized access by thelarger organization.

164.308.a.4.ii.B

Access authorization.
Implement policies andprocedures for granting accessto electronic protected healthinformation, for example,
through access to a workstation,transaction, program, process, orother mechanism.

164.308.a.4.ii.C

Access establishment andmodification. Implement
policies and procedures that,based upon the entity’s accessauthorization policies, establish,
document, review, and modify
a user’s right of access toa workstation, transaction,
program, or process.

Required

To determine user access rights, IGA can base itself on the
CE’s own user directory and the organizations users belong
to, as defined in that directory. The IGA model takes into
account the specificities of each role within each organization(in the broadest definition of this term; see next paragraph).
This is the extended RBAC model, which takes into accountthe position of a user within an organization, just like his roles
or businesses.
This model takes into account the characterizations made by
the various organizations and applies them to their user roles(businesses). This means that a user belonging to the larger
organization will not be granted access rights that are specificto the smaller organization.
Moreover, a user leaving the smaller organization to anotherjob in the larger organization will automatically lose his or her
access rights to the smaller organization’s clearinghouse.
Upon the modification, if permissions and accounts areadded or removed, the user of the portal can configure atransition period during which the coworker can keep all orpart of his previous rights. In this case, the various constraints
defined in the segregation of duty rules are automaticallychecked to make sure that the extension of someauthorizations associated with the old assignment does notconflict with the security policy. At the end of the transition
period, the extended rights are automatically removed.

Addressable

IAM Suite enables organizations to grant access users accessto a variety of resources, including workstations, applications(on-premise/cloud), web resource or other type of data.
Such access can be granted, not just on a per-user basis, butalso based on policies that refer to the CE’s organization as
defined in the corporate directory. Management is therefore
easy, as can be based on rules such as “administrative users
in hospital A can access general medical information”.

Addressable

The security information base of IGA can be accessed on
an as-needed basis, using a graphical interface, to modify,
document, verify, generate reports and launch certification
campaigns to review access rights and ensure they arecompliant with security policies.

45 CFRParagraphs
164.308.a.5.i

164.308.a.5.ii.A

Definitions/
Requirements

Required/
Addressable

IAM Suite featureStandard: Security awareness and training.
Implement a security awareness and training program for all members of its workforce(including management).

Security reminders. Periodic
security updates.

Addressable

Security experts in R&D teams are constantly on the lookout
for new proven or potential threats on these modules, on
security notes issued and security bulletins from different
sources (CERT, Microsoft, etc.), for example regarding
vulnerabilities Apache or OpenSSL.
Evidian also receives security information directly from its
partners. Any security patches are systematically deployed in
the products as soon as possible.
The Web Access Manager module provides users access toprotected web information using a secured portal. As thisportal is the gateway to PHI, it can be used to publish security
reminders.

164.308.a.5.ii.B

Protection from malicious
software. Procedures forguarding against, detecting, andreporting malicious software.

Addressable

In addition, this module has undergone several audits tothis effect, carried out by third parties. These audits haveverified that the products meet the requirements of the
OWASP standard. Conformity checks were carried out
before production started, and minor non-conformities
were corrected within a very short time. No major risk was
identified during these audits. The same principles apply
to technical vulnerabilities within the meaning of the CVSS
standard (http://www.first.org/cvss).

Evidian IAM Suite provides comprehensive auditable dataon a large array of indicators available in reports anddashboards, which includes (but is not limited to):164.308.a.5.ii.C

Log-in monitoring. Procedures
for monitoring log-in attempts
and reporting discrepancies.

• User activity including login attempts
Addressable• Detailed user activity on protected web sites: user
authentications, user authentications risks, password
changes …
• The status of access rights, either individual or rule-based
Administrative actions including user definition, accessgranting etc.
Sophisticated password management features are includedin IAM Suite single sign-on (SSO) modules (E-SSO and WAM).
Primary password policy can be tailored to any organization’s
requirements (alphanumeric characters, etc.).

164.308.a.5.ii.D

Password management.
Procedures for creating,changing, and safeguarding
passwords.

Using graphical administration interface, password policy canbe defined and is implemented automatically. This includes
password expiration dates.
Addressable

Primary and secondary passwords are stored in an
encrypted format inside SSO security directories.
As a safeguard measure, secondary passwords (i.e. individual
passwords for the applications handling PHI) can be
managed automatically. These passwords will be definedand changed without users having any knowledge of them;
they can therefore be as non-intuitive as needed. This meansthat manual procedures need only cover users’ primary
passwords.

HIPAA Security Rule Compliance with Evidian IAM

5

45 CFRParagraphs

164.308.a.6.i

164.308.a.6.ii

164.308.a.7.i

Definitions/
Requirements

Required/
Addressable

IAM Suite featureStandard: Security incident procedures.
Implement policies and procedures to address security incidents.

Response and Reporting.
Identify and respond tosuspected or known security
incidents; mitigate, to the extent
practicable, harmful effects
of security incidents that are
known to the covered entity; anddocument security incidents
and their outcomes.

RequiredIn addition to its extensive reporting, IAM Suite haspredefined dashboards to survey security incidents suchas highlight the risk related to user authentication based ona risk aggregation formula. The user can display the lists ofusers and hosts that have generated failed authentication
events for a given period. An overall level of risk is computedand displayed by hour or by minute.an alerting feature thatcan be configured to warn security administrators when asuspicious situation occurs.
Such live warnings can therefore be incorporated in the
CE’s procedures. A Web console provides a centralized tool
to quickly diagnose the security incident and fix the issue
quickly.

Standard: Contingency plan.
Establish (and implement as needed) policies and procedures for responding to an emergency or otheroccurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that
contain electronic protected health information.

IAM Suite provides options for emergency mode operation.
Access to PHI remains secured in case of emergency,
regardless of whether a systems-damaging accident affects
the network or the IAM Suite security infrastructure itself.

164.308.a.7.ii.C

Emergency mode operation
plan. Establish (and implement
as needed) procedures to enable
continuation of critical businessprocesses for protection of the
security of electronic protected
health information while
operating in emergency mode.

Required• In case of incident on the network, access security
remains active even if the EAM servers are inaccessible.
Local ‘cache’ copies of encrypted data can be configured,on the workstations. Moreover, users’ authentications
rely on the Active Directory high availability (and loadbalancing) procedures already implemented.
• IAM Suite can be installed in a fault-tolerant configuration
so that in case of accident, operation is automaticallytransferred to other security servers. This concerns bothauthentication and administration.
Refer to “High Availability and Contingency Plan” Chapter

164.310.c

6Standard: Workstation security.
Implement physical safeguards for all
workstations that access electronic
protected health information, to restrict
access to authorized users.

Authentication Manager client software can be installedon the user workstation to prevent access without proper
authentication. It is fully compatible with physical security
measures such as smart cards, one-time password (OTP)
devices, biometrics, etc. Such devices can substitute for ID/
passwords in the authentication procedure.

45 CFRParagraphs

164.312.a.1

Definitions/
Requirements

Required/
Addressable

IAM Suite featureStandard: Access control .
Implement technical policies and procedures for electronic information systems that maintain electronic
protected health information to allow access only to those persons or software programs that have been
granted access rights as specified in Sec. 164.308(a)(4).

164.312.a.2.i

Unique user identification.
Assign a unique name and/or number for identifying andtracking user identity.

164.312.a.2.ii

Emergency access procedure.
Establish (and implement
as needed) procedures for
obtaining necessary electronic
protected health information
during an emergency.

Required

IAM suite requires such unique user identification. IGA canassign that user identification itself when the user is createdor can use one that has already been defined by the CE. IGA
then uses it to manage users and assign access rights.

Required

IAM Suite can be deployed in a fault-tolerant configuration
so that PHI is available even if elements of the security
chain are temporarily unavailable. This renders both user
authentication and security administration fault tolerant.

All data are encrypted during transfer using HTTPS with TLS
V.1.2
The solution uses the following encryption mechanisms:
164.312.a.2.iv

Encryption and decryption.
Implement a mechanism toencrypt and decrypt electronic
protected health information.

Addressable• Asymmetrical for connection establishments toapplications / Web API (HTTP / S).
• Symmetric session keys.
• SHA-256 hash functions.
The solution also uses the RSA 1024/2048, AES 256
algorithms.

164.312.bStandard: Audit controls.
Implement hardware, software, and/or
procedural mechanisms that record andexamine activity in information systems
that contain or use electronic protected
health information.

IAM Suite supplies an audit function allowing you to store
the audit events generated by the different modules of thesolution in a centralized database (SQL). The security policy
data is stored in a central repository. The pieces of data may
be viewed through the administration console, the web portal
or a web service

HIPAA Security Rule Compliance with Evidian IAM

7

Brochure

About Evidian
Evidian is the Identity and Access Management (IAM) software suite of Eviden.
Evidian IAM is the European leader in identity and accessmanagement with a presence which is growing rapidly
beyond Europe, particularly in Japan and the US.
More than 5,000,000 users in more than 900 organizations
throughout the world connect to their companies every day
and manage their access rights with Evidian identity and access management solutions.

For more information, please refer to our white
paper “Maintaining HIPAA Compliance with
Identity and Access Management solutions”
Contact us: https://www.evidian.com/company/contact-us/
For more information: https://www.evidian.com/© Eviden. Evidian is the registered trademark of Eviden. All products, brandnames, service marks, trademarks and other names mentioned in this document are proprietary to their respective owners and are protected by applicable trademark and copyright laws. Evidian reserves the right to modify
the characteristics of its products without prior notice.
CT-200807-JR-EVIDIAN-LEAFLET-HIPAA SECURITY RULE COMPLIANCE