HIMSS National Conference New Orleans Convention Center The E-Authentication Initiative E-Authentication: The GSA/HIMSS Authentication Pilot David Temoshok Director, Identity Policy and Management GSA Office of Governmentwide Policy HIMSS National Conference New Orleans Convention Center February 28, 2007

GSA/HIMSS Authentication Project Deploy scalable and interoperable security and identity management infrastructure used for Federal e-Government authentication services in RHIO operating environment. Provide secure, trusted identity credentials. Meet identity management standards for local RHIO deployment. Leverage interoperability and trust with the Federal Government and multiple entities through the Federal Bridge CA and other Federal trust mechanisms. Establish standard enrollment policy and procedures for local registration authorities. Build “lessons learned” for deployment of trusted authentication procedures in other RHIOs.

RHIO Agreements for Pilot Authentication Assurance Levels HSPD-12 PIV Cards Increased $ Cost Multi - Factor Token PKI/ Digital Signature Biometrics Knowledge - Based Very Strong Password High - High PIN/User ID Medium Participants targeted HIGH and VERY HIGH Authentication assurance levels for Pilot Low Access to Access to restricted membership EMR exchange Remote clinical order Protected Market Research Data Increased Need for Identity Assurance

Technology Overview Pilot focus on strong authentication to securely and privately communicate and transfer data within and between RHIOs. Federal eAuthentication is providing trusted PKI service provider – ORC – an approved PKI service provider for the Federal PKI. Certificates used for single factor authentication, digital signature. Tokens (smart cards) used for security, multi-factor authentication, generate digital signature, and secure data storage and transport.

Pilot Scope -- Participating Organizations/RHIOs Connecticut: e-Health Connecticut Michigan: Michigan Data Sharing & Transaction Infrastructure Project Texas: CHRISTUS Health, health eCities of Texas Project Minnesota: Community Health Information Collaborative Ohio: Supercomputer Center Bioinformatics Ohio: Virtual Medical Network Nevada: Single Portal Medical Record Project

Pilot Authentication Technical Overview Pilot focus on strong authentication to securely and privately communicate and transfer data within and between RHIOs. Trusted Federal PKI Credential Service Provider to provide digital certificates for authorized end users in each RHIO. Local Registration Authorities trained and certified for each RHIO. Standard certificates used for single factor authentication, digital signature. Tokens (smart cards) used for security, multi-factor authentication, generate digital signature, and secure data storage and transport. Federal PKI architecture employs multiple certificate validation protocols.

Pilot Demonstrations and Conclusions Pilot demonstrated: Multiple RHIOs can agree and implement a common framework for the policies, procedures, and standards for federated identity authentication across multiple use cases. The Federal e-Authentication infrastructure is relevant and applicable to use cases for RHIOs in diverse operational environments. PKI, as a standard for strong authentication, can be deployed uniformly across multiple RHIOs. The Federal PKI and its trusted Federal Credential Service Providers can be leveraged for use in multiple use cases across multiple RHIOs. For RHIOs, local registration authorities and local enrollment are viable for larger scale deployments to provide for strong authentication using Federal e-Authentication components. Hardware tokens (i.e., smart cards, flash drives) are viable for RHIO deployment of level 4 authentication assurance.

Next Steps Expand current pilot: Expand RHIO demonstration project population from 7 to X to implement a common framework for the policies, procedures, and standards for identity authentication across multiple use cases. Establish standard procedures for local enrollment: Standardize local enrollment procedures and development of a standard scheduling tool are critical for larger scale deployment. Establish contract arrangements: Federal approved service providers are available on GSA schedules. New providers need to be added to contract on GSA IT Schedule 70. Expand current pilot functionality and scope: to include first responders and emergency response providers in coordination with the Federal Department of Homeland Security. Establish Governance Structure: for decision-making.

For More Information Visit our Websites: Or contact: http://idmanagement.gov http://cio.gov/eauthentication http://.cio.gov/ficc http://cio.gov/fpkipa http://csrc.nist.gov/piv-project/ http://eapartnership.org Or contact: David Temoshok Director, Identity Policy and Management 202-208-7655 david.temoshok@gsa.gov