SailPoint NERM: Mitigating Third-Party Cyber Risk in Healthcare
Introduction
In modern healthcare, the delivery of quality patient care increasingly relies on a diverse workforce that extends beyond traditional employees. These include agency or travel nurses, outsourced lab and pharmacy workers, affiliated physician’s offices, external researchers and professional services contractors such as IT or environmental services, among others. Additionally, healthcare organizations are becoming more integrated with educational institutions to build a pipeline of future doctors, nurses and other healthcare providers. While these users bring valuable skills and flexibility to healthcare organizations, managing these non-employees poses significant cyber security challenges. Cyber threats can compromise patient data, disrupt clinical processes, and lead to substantial financial losses. SailPoint Non-Employee Risk Management (NERM) emerges as a strategic approach to help address these challenges, providing a more automated and efficient approach to user lifecycle management for external users.
Non-employee risk in healthcare
Healthcare organizations are inherently data-rich environments, containing sensitive information such as patient medical records, billing details, and proprietary clinical research. The involvement of non-employees multiplies the points of access to this data, increasing the vulnerability landscape. Some of the major risk factors and operational inefficiencies associated with non-employees in healthcare include:
1
2
3
4
5
Given these factors, traditional management methods may fall short in addressing the cyber risks associated with non-employees. This is where NERM comes into play, offering a robust platform to manage these risks effectively.
SailPoint NERM
SailPoint NERM focuses on creating a streamlined, secure approach to non-employee lifecycle management, which can help to reduce cybersecurity risks in healthcare settings. The solution encompasses several key components:
In conjunction with SailPoint Identity Security Cloud, automation helps to ensure that non-employees receive timely access to necessary resources upon joining and have their access revoked promptly upon termination. This reduces administrative workload and can minimize the risk of lingering access post-employment.
Rigorous identity verification leveraging third party identity proofing solutions helps ensure that only verified individuals gain access to sensitive systems, preventing unauthorized breaches.
The volume of some Personas, such as students, can create a significant administrative burden on the organization as it relates to onboarding and offboarding. NERM allows for external collaboration and delegated administration, offloading the data entry and management of users to affiliated entities while still allowing oversight and control by the host organization.
Potential benefits for healthcare organizations
Implementing SailPoint NERM can provide benefits for healthcare institutions, such as:
- Enhanced security: With automated lifecycle management, healthcare organizations can effectively safeguard patient data from unauthorized access and potential breaches.
- Compliance assurance: The continuous monitoring and auditing features helps to ensure that access management complies with HIPAA and other regulations, mitigating legal and financial risks.
- Operational efficiency: Automation reduces manual administrative tasks, allowing HR and IT departments to focus on strategic initiatives, thereby improving overall organizational efficiency.
- Cost savings: Efficient management of non-employee access reduces overhead costs related to manual oversight and error rectification, channeling resources towards patient care and innovative health solutions. Additionally, if non-employees are currently managed across multiple systems, those systems could be consolidated into NERM, thereby reducing support overhead and shrinking the technology footprint.
Implementation leading practices
To successfully harness NERM’s benefits, healthcare organizations should adhere to certain leading practices:
- Cross-departmental coordination: Foster collaboration between HR, IT, compliance, and clinical departments to achieve a cohesive approach to non-employee management.
- Assess current data: Evaluate existing data around non-employees and enrich or normalize as needed to improve ease of migration into NERM.
- Review current access protocols and policies: Review the current access management protocols and policies and identify attributes/parameters which should be captured during the onboarding process to help improve automation capabilities.
Conclusion
As healthcare organizations increasingly rely on non-employees to deliver quality care, managing the cybersecurity risks associated with this workforce becomes critical. SailPoint Non-Employee Risk Management (NERM) provides a robust, automated solution that addresses key challenges related to managing the lifecycle of non-employees and their associated access.
KPMG LLP is a trusted collaborator to healthcare organizations in implementing NERM, leveraging our relationship with SailPoint and our deep expertise in the Identity Governance and Access Management space to deploy a scalable and sustainable solution for managing non-employed users. With the ability to design and develop use cases for both NERM and Identity Security Cloud, KPMG can help deliver user lifecycle and access management capabilities end-to-end, from onboarding and management to provisioning and attestation. Our leadership in both the Identity space and healthcare sector allow us to bring leading practices to our clients.
Meet our team
