Transcript
I'm Neil Coy, Vice President of Global Delivery Services at SailPoint. In this series, we discuss identity security cloud product extensions, tools and processes that leverage the Atlas platform. We deep dive into our clients' security goals with an aim to defend against today's identity-centric threats. With that, welcome and enjoy. Today, I'm joined by Hardik Modi, Senior Director of Identity Management at IDM Works, and Chad Hoffart, Information Security Architect at Nebraska Methodist Health System. Welcome, Hardik and Chad. Thanks for making the time today. Thank you. Yeah, thanks, Neil. Absolutely. So before we jump into the discussion, I want to take a second to provide some context and background for our audience. Chad, can you start by explaining the challenge Methodist Health System was facing and how you were approaching it? Yeah, we're relatively, what I'll call, I guess, new in our journey with SailPoint. We went live late 22, early 23, and not long after go live, the health system determined that we wanted to replace one of our authoritative sources, which being so young in our journey was a bit startling. So obviously, we wanted to lean on our implementation partner. They were familiar with us, IDM Works and Hardik. So we reached out to them immediately to kind of help us kind of think through that challenge, how that would work doing a rip and replace of one of our authoritative sources. So the way we kind of initially approached it was not only reaching out to them, but using the SailPoint resources such as the health care users group, reaching out to others within that user group. And then we quickly realized that we weren't alone in kind of the challenge we were facing. There was others kind of asking about this VerityStream credentialing system and how are others tackling this? And at that point, it made sense to me to see whether SailPoint was open. I know there was no out-of-the-box connector when I looked. Was SailPoint working on this? When I reached out to SailPoint, they indicated that, yes, they would like to pursue this. I think they have some challenges connecting with the right resources at HealthStream. Who is the vendor for VerityStream? So at that point, we kind of played matchmaker. We set up a call. Hardik was on that call, our contacts from HealthStream, and then we got in touch with the right resources at SailPoint and made those introductions. And I guess the rest is kind of history from there. That's fantastic. Thanks, Chad. Hardik, anything you want to throw in there before I pop into kind of the first big topic? No, I guess what Chad mentioned, like, of course, there was some traditional provider system, again, with that cloud-first mindset, right? The move is pretty much from the echo to VerityStream, to at least have the more visibility around how Methodist health system visualize the data, right? Visualize visibility into the speciality codes, right? Whether the providers into the radiology or the pathology or even the gastroenterology, right? And then, of course, facility codes, because Methodist health system consists of three hospitals and then countless facilities that they support on their day in, day out, right? So at least the visibility on those arena was very important. And that was primary reason that the integration with the VerityStream was very much important. Thanks, Hardik. Well, let's dive a little deeper. So Hardik is one of SailPoint's delivery admiral partners. You built tools to address unique customer problems across hundreds of clients. Can you talk about how you leverage your experience integrating with the VerityStream system for other customers and how that helped inform the build of this new out-of-the-box connector working alongside the SailPoint product team? From our previous integration experience with VerityStream, we have learned some key lessons that have been important in shaping our approach. Firstly, I guess the complex data mappings. VerityStream's data structure required mappings to ensure accurate synchronizations with the downstream systems. Our experience enabled us to develop those advanced mappings, particularly around multi-value attributes through the API call set, because again, there are same providers working into the multiple facilities, right? Maybe the same provider may be inactive into one of the facility calls, right? So we want to make sure that we do have those precision on how we ingest the data and then how we pass through the downstream system, right? So that past experience was very important. Secondly, the understanding of the applications, right? I guess for me, that was super important, very crucial. VerityStream's API are pretty much highly interconnected and that requires those iterative API calls with the complex filtration criteria to extract specific values. And again, this understanding of those API structure was essential in implementing those workflows effectively, because again, within the healthcare industry, you would have those standard multi-persona use cases where you would have that employee provider versus the non-employee providers, visiting providers, right? So we want to essentially make sure that our understanding allows us to correctly interpret and then map those data points. And then the third aspect of this integration was data sensitivity and compliance, right? We understand how critical it is to manage those data that is flowing between the various systems. And then again, you need to keep in mind those healthcare regulatory frameworks, whether it's a HIPAA, PHI or HITECH. Our team assisted in defining those use cases, requirements, designs, such a way that it meets that sale point best practices around the implementations. But at the same time, it handles with the patient care with quick onboarding of those providers. We have also shared the most pressing attributes and API details with the sale point product team. That would eventually help sale point product team to build this out-of-the-box integrations. And then that could be helpful to the larger ecosystem, right? I guess that would be that main goal. One of the biggest challenge that we faced as part of this integrations was handling those large volume of data without degrading those performance, right? So we tackled this challenge by optimizing API calls, countless call with the VerityStream team, and then implementing our logic around paginations. And then, of course, to manage those data efficiently. Once this integrations was available between the VerityStream and then sale point, I guess we were able to see those positive outcomes, right? The biggest thing for me was, of course, time to value, because provider onboarding time was pretty much significantly reduced. Providers who are focused on those mission-critical patient care were onboarded faster and more seamlessly, granting them those quicker access to the clinical applications and enabling them to support patient care more effectively. I guess that's the biggest for me. Of course, number two for me was a cost savings, right? That's another positive outcome. With automation in place around those lifecycle events, workflows, hospitals such as Methodist Health Systems, right? Those benefited from those reduced, I would say, that administrative cost, and the savings pretty much allowed resources to be reallocated to the other initiatives. And then, essentially, this will, once you set something into that autopilot mode, I guess it will ultimately lower those incident calls. Next, from my eyes, compliance, and then, of course, audit passing rate, right? Because, again, with those reduced manual intervention in lifecycle events, like the passing of those audit controls, whether it's an external or internal, I guess the likelihood would be those increased. And then make sure that Methodist Health System essentially falls with those compliance requirements. And then last but not the least, I would say that better security posture. I guess that's the key thing, right? Especially into that healthcare industry where, again, providers working to the multiple hospitals, multiple clinics. The only thing I would say is it's never as simple as you think it's going to be. I think there's a jellyfish analogy that IDM Works uses where they show the top-down look at a jellyfish. And then when you turn it on its side, you get to see all the tentacles. And that's really what these projects are. So relying on someone with that experience, I think, is critical when it's one of your foundational authoritative sources. No doubt. First of all, I'm going to steal that jellyfish analogy, Hardik. I love it. So just to dive into the cost savings for a second. You know, when we first start talking to prospective clients, we bring in business value assessment that talks to cost savings, you know, at a very high level. But it's nice every now and then to think about where we can get cost savings during the project, right? Hey, we can go in and implement this change, and this is kind of the cost savings outcome. Is there anything you can throw in there from a cost savings specifics around VerityStream that we were like, hey, this one aspect really allowed us to tune and tweak what we do and save some time? So personally, I don't think we're quite there yet. But what we're doing is building the foundation. So we didn't want to just take what we have in the current system and replicate it. What we tried to do is enhance that and pull the information that will lead to that cost savings that you're referencing. So we were kind of just getting out of the blocks when this decision was made. So we kind of had to pump the brakes and tear out part of that foundation and replace it. And so now the project that we have in place right now is going to set us up to realize that by pulling the right attributes so we can streamline those things like provisioning access to our EMR and downstream system. So I think that's where we'll really realize that cost savings with provider onboarding and offboarding as well. Sure. Thanks, Chad. So Hardik, I'm going to head back over to you and talk a little tech. So you kind of touched on it once or twice in terms of maybe some of the APIs and other things, but what technologies and frameworks serve as the foundation for the new VerityStream connector? And then how does that help address identity related challenges in the overall health care industry? Correct. OK. So again, to build these integrations, we have used, of course, SailPoint's Atlas platform, which is on identity security cloud, and then to consume this VerityStream data. We have used those RESTful endpoints to have those bidirectional communications between the Atlas platform and VerityStream. For the authentications we have used, Verity has something called Verity Auth for that authentication mechanism. And then for the authorizations, we have leveraged those JSON web tokens. Like this is a pretty much industry standard around how you authenticate and authorize to pull the data and at least provision some of those activities. So again, by aggregating those data into the SailPoint platform, we have again, definitely, absolutely followed those regulatory framework as well as other internal audit control just to make sure that we pull the data on a need to know basis. But once we have these integrations available, we are able to address some of the biggest challenges in the health care industry. For me, I guess the biggest one would be that lack of visibility into the providers or any other populations into the health care vertical altogether. So visibility is the key. That's a period. And again, with these integrations, Chad and team have a full visibility of all the providers that are serving Methodist health system. And then again, with having that visibility into the provider information, SailPoint provided that secure experience while accessing the patient data by ensuring that right providers can access those sensitive data, thus mitigating those risk of breaches or even unauthorized access. With all of this control in the place, Chad and team essentially setting up, as Chad mentioned, like setting up those strong foundations to essentially implement that certification process or even that access request right down the line to comply with those HIPAA and PHI regulatory framework. Sure. So since you talk a little bit about integration there, how easy is it to lift and shift this solution from Methodist over to the next hospital system? From the lift and shift perspective, I would say that the integration is a fairly straightforward, right? Bearing, I would say that some of the challenges that are addressed during the use case built up and then design sessions, right? How the data mapping is done, and this is where partners like IDM Works can help, right? Where we take the experience we have in the past using our standard methodology of deployments around data gathering, addressing the processes, how data is going to flow from one system to another system, right? Because, again, let's be honest, like each hospitals are different on how they operate. Again, similar concept applies to some of the clinical applications, right? And this is where we see one of the challenges, right, around the data mapping, as it could have the different data schemas, formats, attributes across the platform, right? But during these workshops, we map out those transformations requirements and normalize the data between the systems. And again, as we build these integrations, another common challenge that we have seen within the provider community is lack of adoption of technology, right? And this is where we use our experience to work with organizational change management for the wider adoption, because this is the area I would say that often overlooked, right? And that causes that lack of adoption, right? I do have a technology in place, but no one is using it, right? People, providers still calling the help desk, right? So we wanted to avoid this one. So this is where we work with organizational change management communication team to provide the training to the user populations, provider populations, help desk. So transition from those manual workflows to the automated workflows are as seamless as possible. As you build some of these integrations, my recommendations would be have that early engagement of that stakeholders. Of course, my second one would be start with the clear scope and then outcomes, right? I guess the definition of that objectives would be super helpful. Begin with the small scale pilot, maybe start with the one or two facilities before launching hospital wide, right? So that way, if there are any potential issues that pops up, I guess this will give us enough time to fix it, resolve it, and then move on. That's super helpful, Hardik. So Chad, just kind of deep diving into one of the points where Hardik meant, what was your rollout process like? Did you guys go hospital wide? Did you go smaller? What did that look like from your user perspective? You know, maybe throw in a little change management details as well. I'm sure a lot of folks would love to hear about that. So our go live was more, I guess, behind the scenes from a provisioning perspective. Our project was, I guess, a sub project of the ERP implementation that we were in the middle of. So that provisioning piece was mostly like for like from our old system that we were replacing. So it was mostly invisible to the end user. However, we did implement the self-service password reset functionality as part of our implementation. And so we partnered with our marketing team to get that communication out. And obviously, for each population and each, I guess I'll call it profile or authoritative source, we targeted our communication to those groups. So students, providers and employees. So it's keeping the audience in mind as you address each group, I'd say. I like it, Chad. Thanks. So sticking with you, Chad, we're going to swing over to regulatory requirements for a second. So how does VerityStream Connectivity cater to kind of the regulatory requirements within the health care industry? So I think it really circles back to HIPAA and making sure that the right people have the right access to your EMR, really, or PHI in general. And the way we do that is by connecting to VerityStream for providers to make sure that their lifecycle state is correct within SailPoint. If we have an applicant in the system, we obviously don't want to give them full access to our EMR. So that's reflected in our in our processes. And it's just it's really that basic and expanding from there. So beyond is their lifecycle state correct? Do they have access to the right data for the organizations that they're active in within the health system? So that's I would just say at a high level, that's how it would help us from a regulatory perspective. Thanks, Chad. Hardik, anything you throw in there? I would add that in addition to this compliance, I guess the configurable workflows with this integration. Right. So using that SailPoint Atlas platform that are specifically designed for those health care operations. This pretty much workflows, streamlines those processes like the provider onboarding, offboarding, credentialing, pretty much reducing those administrative burdens and enhancing the accuracy and speed of those essential functions. And again, this is our foundations. Right. So down the line, it paves the way for building that robust role based access control, whether you are working into the emergency or working to the clinic. Right. Because we do have that multiple facility codes, specialty codes, organizations. So down the line, we are looking to have that full role based access control model so that we move more towards that list of privilege principle basis. And again, this integration that we have developed is highly customizable to cater the needs for those different health care organizations. Right. Whether you are a large hospital network like Methodist Health System or a smaller medical practice. I guess that flexibility ensures that that integration can adapt the unique regulatory landscape and then operational requirements of that various health care providers, whether you are an employee provider or the non-employee providers. Well, I can tell you it's always stressful when you have to replace an authoritative source and sounds like you guys did this one by the book and absolutely knocked it out of the park. So congratulations on both sides. Look, guys, this has been a great conversation. Thank you again, Hardik and Chad for sharing your experiences. I hope this has been insightful for those watching. Thank you and have a great day. You.
