Enrolling Authentication Methods for Imprivata Confirm ID Workflows

The following sections explain how to enroll authentication methods for authenticating with Imprivata Confirm ID.

Download a PDF of this guide to distribute to users; it explains how to enroll their authentication methods for Imprivata Confirm ID.

Enrollment Workflows

To open the Imprivata Confirm ID enrollment utility, click the Imprivata icon in the Windows notification area (Imprivata agent menu), and then click Enroll Authentication Methods.

If you are enrolling authentication methods in the presence of an enrollment supervisor, then you can log into the enrollment utility using any of your enrolled authentication methods, in addition to your username and password.

NOTE: Users will receive a confirmation email for each authentication method they enroll. If a user notifies you of a suspect enrollment confirmation email, disable the user's account and investigate the issue.

This feature is enabled by default and can only be changed by an Imprivata Confirm ID Super Administrator. The setting is located in the Imprivata Admin Console (gear icon menu > Settings > Email configuration section).

Based on the required Imprivata ID feature, make sure that the following requirements are met.

NOTE: Unless otherwise noted, a requirement applies to all Imprivata ID features.

iOS Requirements

  • iOS 11 or later installed.

  • An active Internet connection is required to enroll Imprivata ID, as well as to send log files to Imprivata.

  • Hands Free Authentication:

    • Bluetooth enabled.
    • Access to Location Services (Always).
    • An active Internet connection is not required for Hands Free Authentication or manual token code entry.

  • Remote Access:

    • Notifications enabled.
    • An active Internet connection is required for push notifications.

  • Secure Walk Away

    • iPhone 6s or later.

    • Access to Location Services (Always), Bluetooth Sharing, and Motion & Fitness is required.

  • QR code for direct access to the download page on the iTunes App Store:

Android Requirements

  • Android 6 or later installed.

  • An active Internet connection is required to enroll Imprivata ID, as well as to send log files to Imprivata.

  • Hands Free Authentication:

    • Bluetooth enabled.

    • An active Internet connection is not required for Hands Free Authentication or manual token code entry.

  • Remote Access:

    • Notifications enabled.

    • An active Internet connection is required for push notifications.

  • Secure Walk Away:

    • Samsung Galaxy S7 or later.

    • Google Pixel 1 or later.

    • OnePlus 6 or later.

    • Bluetooth enabled.

  • QR code for direct access to the download page on Google Play:

  1. Open the Imprivata ID app on your device.

  2. Log into the Imprivata Confirm ID enrollment utility on a computer: Click the Imprivata icon in the Windows notification area (Imprivata agent menu), and then click Enroll Authentication Methods.

    The authentication methods available for you to enroll are displayed:

  3. Click Get Started! or Enroll your Imprivata ID on the enrollment utility home screen. The Enroll your Imprivata ID screen opens.

  4. Enter the 12 character serial number and six digit token code displayed on the Imprivata ID app screen.

  5. Click Done.

  6. When your Imprivata ID is successfully enrolled, your device's name appears on the Imprivata Confirm ID enrollment utility screen. Click Done.

    NOTE: You can enroll multiple Imprivata IDs. To enroll another Imprivata ID on a different device now, click Enroll another. If you want to enroll later, perform the steps in this section again when you are ready.

  7. If you are enrolling in the presence of an enrollment supervisor, the supervisor authenticates to witness your enrollment.

You can allow users to remotely enroll Imprivata ID after enrolling at least one second factor. After a user replaces their device, they can enroll Imprivata ID on the new device without calling your IT helpdesk first:

  1. In the Imprivata Admin Console, go to Users > Workflow policy.

  2. Go to Remote access workflows > Log In > Self-service and check Allow users to remotely enroll and manage authentication methods

  3. Click Save.

  • When enabled, Self Service Enrollment is an option for all users associated with the Remote Access Log In workflow (if your Log In workflow includes Imprivata ID.)

  • Self Service Enrollment is available only for remote access gateways that use Imprivata cloud-based authentication with the Imprivata Confirm ID graphical user interface. The legacy RADIUS remote access experience does not support Self Service Enrollment.

CAUTION:

When clinicians replace their device with a new model, their EPCS Allowed Imprivata ID enrollment is not carried forward to the new device. Self service enrollment of Imprivata ID does not replace the EPCS Allowed enrollment required for Imprivata ID.

These users can enroll Imprivata ID on their new device for remote access as described below, but before they can use Imprivata ID on their new device for EPCS workflows, they will first need to confirm their email and phone number.

Typical User Workflow

A user has upgraded to a new device. Imprivata ID was restored from a backup automatically to the new device. The user may not realize Imprivata ID must be re-enrolled on the new device.

  1. The user enters his username and password in the Imprivata Confirm ID interface at his remote access gateway.

  2. He clicks Log in. Imprivata Confirm ID sends a push notification to his old device only.

  3. The user sees onscreen that Imprivata ID is waiting for him to approve the notification, but the model of his old device is displayed. This visual cue is designed to prompt the user to take action. (The onscreen model display is a feature improvement for all push notifications.)

  4. The user does not have to call your helpdesk. The user clicks Add new device instead.

    The user must complete a second authentication before they can enroll Imprivata ID.

    BEST PRACTICE:

    When rolling out Imprivata ID to your users, require users to enroll their phone number for SMS authentication. SMS authentication is the easiest method in this case; the user could also authenticate with Imprivata ID on their old device (if he still has it) or call your helpdesk for a temporary code.

  5. The user clicks SMS code. Imprivata Confirm ID sends an SMS code to his device (the user kept his phone number when he upgraded his device, so his SMS enrollment is unchanged.)

  6. The user receives the SMS message on his new device, enters the verification code onscreen, and clicks Confirm your identity.

  7. The Enroll your Imprivata ID screen opens. The user opens the Imprivata ID app on his new device, enters the serial number and token code from the app, and clicks Submit.

    The user's Imprivata ID is enrolled. After he clicks Done his remote access gateway opens as usual. The next time he logs in remotely, Imprivata ID on his new device will receive the push notification by default.

    Imprivata ID on his old device is still enrolled, will continue to receive push notifications, and can continue to be used unless deleted by the user or your Imprivata Confirm ID administrator.

When a clinician replaces her device with a new model, or she restores, replaces, or reinstalls Imprivata ID for any reason, her EPCS-allowed Imprivata ID enrollment is not carried forward to the new device.

For an Institutionally identity proofed provider, the clinician must have at least two EPCS-allowed methods available to self-enroll a new Imprivata ID, if self-enrollment is allowed by their organization. Alternatively, if a provider does not have enough EPCS-allowed methods to self-enroll, or self-enrollment is not enabled, then the provider can enroll a new Imprivata ID with a supervisor who witnesses the enrollment.

For an Individually identity proofed provider, the clinician does not need to repeat identity proofing, but before she can use Imprivata ID on her new device for EPCS workflows, she will need to confirm the same email and phone number as she did during Identity Proofing.

Imprivata Confirm ID supports SMS text notifications to any device that accepts SMS messaging, including devices not supported by Imprivata ID.

NOTE: You must have your device with you to enroll your phone number.

To enroll a phone number:

  1. Log into the Imprivata Confirm ID enrollment utility on a computer: Click the Imprivata icon in the Windows notification area (Imprivata agent menu), and then click Enroll Authentication Methods.

    The authentication methods available for you to enroll are displayed.

  2. Select Enroll your mobile phone number.

  3. Enter your mobile phone number with area code (Message and data rates may apply).

  4. A text message is sent to your device. Enter the verification code from that message.

  5. You will receive a confirmation email after the enrollment is complete. If you receive an confirmation email for an authentication method that you did not enroll, contact your Imprivata Confirm ID administrator immediately.

NOTE: If you need to change to a different phone number in the future, contact your help desk.

Enrolling Your Phone Number While Logging In Remotely

Imprivata Confirm ID Remote Access Users may also be configured to enroll their phone number while logging into their VPN gateway or Microsoft AD FS client. The workflow is identical.

NOTE: You may be required to enroll in the presence of an enrollment supervisor.

IMPORTANT: A FIPS-compliant fingerprint reader must be used to enroll the fingerprints of providers who are approved to e-prescribe controlled substances.

To enroll one finger, the enrollment utility must successfully scan the finger three times to learn the fingerprint, then a fourth time to verify that the scanned fingerprint has been successfully enrolled.

BEST PRACTICE: Enroll two fingers (preferably both index fingers) in case a single finger authentication fails.

To enroll fingers:

  1. Click Get Started! or Enroll your fingerprints on the enrollment screen.

  2. Click the onscreen finger you will use to identify yourself.

  3. Place and hold or swipe your finger on the reader. Each scan is not successfully completed until a green check mark appears.

  4. When prompted, place and hold or swipe the same finger a second time.

  5. When prompted, place and hold or swipe the same finger a third time.

  6. Place and hold or swipe the same finger on the reader a fourth time to confirm Imprivata Confirm ID can use the first three scans to authenticate you in the future.

  7. Click another onscreen finger to enroll, or click Done.

  8. If you are enrolling in the presence of an enrollment supervisor, the supervisor authenticates to witness your enrollment.

  9. You will receive a confirmation email after the enrollment is complete. If you receive an confirmation email for an authentication method that you did not enroll, contact your Imprivata Confirm ID administrator immediately.

You can enroll your fingerprints if you have completed identity proofing and have a Symantec VIP credential or Imprivata ID.

IMPORTANT: A FIPS-compliant fingerprint reader must be used to enroll the fingerprints of providers who are approved to e-prescribe controlled substances.

To enroll one finger, Imprivata Confirm ID must successfully scan the finger three times to learn the fingerprint, then a fourth time to verify that the scanned fingerprint has been successfully enrolled.

BEST PRACTICE: Enroll two fingers (preferably both index fingers) in case a single finger authentication fails.

To enroll fingers:

  1. Click Enroll your fingerprints on the enrollment screen.

  2. Click the onscreen finger you will use to identify yourself.

  3. Enter your Symantec VIP credential or Imprivata ID and your password.

  4. Place or swipe your finger on the reader. Each scan is not successfully completed until a green check mark appears.

  5. When prompted, place and hold or swipe the same finger a second time.

  6. When prompted, place and hold or swipe the same finger a third time.

  7. Place and hold or swipe the same finger on the reader a fourth time to confirm Imprivata Confirm ID can use the first three scans to authenticate you in the future.

  8. Click another onscreen finger to enroll, or click Done.

  9. When you're done, log out of the enrollment utility.

  10. You will receive a confirmation email after the enrollment is complete. If you receive an confirmation email for an authentication method that you did not enroll, contact your Imprivata Confirm ID administrator immediately.

NOTE: You may be required to enroll in the presence of an enrollment supervisor.

To enroll a one-time password token ("OTP," "token," or "keyfob"):

  1. Click Get Started! or Enroll a one-time password token on the enrollment screen.

  2. Select the type of token to enroll.

  3. Follow the on-screen directions to enter the device serial number, token passcode, or Symantec credential token, as needed.

  4. Click Done.

  5. If you are enrolling in the presence of an enrollment supervisor, the supervisor authenticates to witness your enrollment.

  6. You will receive a confirmation email after the enrollment is complete. If you receive an confirmation email for an authentication method that you did not enroll, contact your Imprivata Confirm ID administrator immediately.

To enroll a badge (proximity card):

  1. Select Enroll a badge on the Imprivata Confirm ID enrollment screen.

  2. Tap the badge on the reader when prompted.

  3. After the badge has been successfully enrolled, click I'm done or Enroll another badge to continue.

  4. You will receive a confirmation email after the enrollment is complete. If you receive an confirmation email for an authentication method that you did not enroll, contact your Imprivata Confirm ID administrator immediately.

The sections below describe how to enroll your facial biometric (your facial image) as an authentication method. Only institutional providers who perform electronic prescription of controlled substances (EPCS) are eligible to enroll their facial biometric. (Institutional providers are not identity proofed by a Certificate Authority (CA) such as DigiCert or a Credential Services Provider (CSP) such as Symantec Norton Secure Login.)

Facial biometric supports only one workflow: institutional providers who perform EPCS can use their facial biometric to enroll Imprivata ID on a mobile device to use for EPCS, often to replace an older mobile device they no longer use. This enrollment of Imprivata ID does not require a fingerprint reader or a supervisor witness, nor does it require the provider to still have their old mobile device if they have replaced it. The workflow is described in Enrolling Your Imprivata ID for EPCS Using Your Facial Biometric .

Mobile EPCS also supports using facial biometric as an authentication method. For details on allowed authentication methods, see Configure Workflows.

NOTE:

You may (see Requirements) need to enroll your facial biometric either in the presence of an enrollment supervisor or when actively communicating remotely with an enrollment supervisor, who must enable and witness your enrollment. This documentation assumes you are in the presence of an enrollment supervisor.

If you are communicating remotely with an enrollment supervisor, also see Remote Institutional ID Proofing for EPCS for related information.

You must have your mobile device with you.

Requirements

  • For mobile device and mobile operating system requirements, see Imprivata Confirm ID Supported Components.

  • The latest Imprivata ID app version available on the App Store must be on your mobile device.

  • The computer on which you perform part of this procedure must be running the Imprivata agent, identified by the red Imprivata icon in the system tray. Agent version 7.4 or later is required for supervised (witnessed) enrollment of a facial biometric. Agent version 7.5 or later is required for unsupervised (unwitnessed) enrollment or unsupervised deletion of a facial biometric.

  • You must have already enrolled Imprivata ID as an authentication method on your mobile device. If you need to check this enrollment, when Imprivata ID is enrolled on your device, your device's name appears under Enrolled authentication methods on the Imprivata enrollment utility screen, as shown in step 1 of Provider Enrolling Their Facial Biometric. This enrolled authentication method does not have to be allowed for EPCS. If you have not yet enrolled Imprivata ID on your mobile device, see Enrolling Your Imprivata ID.

  • To perform unsupervised enrollment or unsupervised deletion of your facial biometric, administrator configuration setting Facial biometric must always be supervised must be deselected (unchecked) on the Confirm ID enrollment supervisors page. Otherwise, an enrollment must be enabled and witnessed by an enrollment supervisor and a deletion must be enabled (but not witnessed) by an enrollment supervisor. An Imprivata administrator can access the Confirm ID enrollment supervisors page using the Imprivata Admin Console > Users menu > Enrollment Supervisors.

  • To perform unsupervised enrollment of your facial biometric, you must have two or more authentication methods that are EPCS allowed (one of these may be a password). Otherwise, your enrollment must be supervised (enabled and witnessed) by an enrollment supervisor. EPCS allowed authentication methods are selected by your organization and may include Imprivata ID, fingerprints, and One-Time Password (OTP) tokens.

  • Your computer and your mobile device must be connected to the Internet.

Two-Part or Four-Part Procedure

The procedure to enroll your facial biometric has either two or four parts, depending on whether your enrollment must be supervised (see Requirements). For unsupervised enrollment, perform only parts 2 and 3. For supervised enrollment, complete all four parts. You must complete the parts in sequence.

  1. Supervisor Enabling Facial Biometric Enrollment.

  2. Provider Enrolling Their Facial Biometric.

  3. Provider Verifying Their Facial Biometric.

  4. Supervisor Witnessing Facial Biometric Enrollment .

The procedure is followed by a Troubleshooting section for this procedure.

Finally, a section describes Deleting a Facial Biometric.

For a supervised enrollment, an enrollment supervisor must perform these steps to enable a provider's facial biometric enrollment:

  1. Access the Imprivata enrollment utility by clicking on the red Imprivata agent icon in the computer system tray and selecting Enroll Authentication Methods.
    The enrollment utility launches.

  2. The supervisor logs into the enrollment utility.

  3. Click Enroll providers. The Enroll providers window opens:

  4. Enter the provider's username and select the matching name from the drop-down list.

  5. Optionally or if required by your organization, select the form of identification that you verified and enter any comments in the Additional comments field.

  6. Click Go to provider login. The enrollment utility login window appears for the provider, who must now proceed to Provider Enrolling Their Facial Biometric. When the provider is done enrolling and verifying their facial biometric, the supervisor must witness the provider's enrollment in Supervisor Witnessing Facial Biometric Enrollment .

The provider must perform these steps to enroll their facial biometric:

  1. For an unsupervised enrollment: access the Imprivata enrollment utility by clicking on the red Imprivata agent icon in the computer system tray and selecting Enroll Authentication Methods. The enrollment utility launches. Log into the enrollment utility using your provider password.

    For a supervised enrollment: on the computer used in the previous section, log into the displayed enrollment utility using your provider password.

    Your provider enrolled and enrollable authentication methods are displayed, for example:

    If the displayed window shows that you have not enrolled Imprivata ID on your mobile device, or that you have no enrolled authentication methods, then you must first enroll Imprivata ID on your mobile device as described in Enrolling Your Imprivata ID. Complete that process and then return to either step 1 in Supervisor Enabling Facial Biometric Enrollment for a supervised enrollment, or to step 1 in Provider Enrolling Their Facial Biometric for an unsupervised enrollment.

  2. Click Enroll facial biometric. (If this option is disabled, see Troubleshooting.)

    For an unsupervised enrollment: the two-factor authentication page displays and you must authenticate with two methods that are EPCS-allowed, for example, your password and using the Imprivata ID app on your mobile device. Complete that authentication.

    For a supervised enrollment: two-factor authentication is not required.

    A list of your mobile devices that contain an enrolled Imprivata ID is displayed:

  3. Select the device you will use to enroll your facial biometric and click Begin set up.

  4. On your mobile device, open the Imprivata ID app:

  5. On your computer, enter the token code from the Imprivata ID app and click Continue.

    The application instructs you to accept notification from Imprivata ID on your mobile device and to follow the instructions on that device to continue.

  6. On your mobile device, tap on the notification that says Set up facial biometric:

    The mobile display changes to:

  7. Click Continue. The mobile display changes to:

  8. Click OK. The camera activates.

  9. Follow the displayed instructions to properly position the device to capture an image of your face.

    The app then takes the picture automatically and reports that it is processing the image:

    If the image was captured successfully, the display shows Face captured, Continue enrolling on your desktop workstation.

    On your computer, the Imprivata enrollment utility also indicates that your face was captured successfully.

    If the image was not captured successfully, then on your computer, click Try again and return to Step 4.

  10. After the image is captured successfully, go to Provider Verifying Their Facial Biometric, which is required.

The provider must perform these steps to verify their facial biometric:

  1. On your computer, the Imprivata enrollment utility indicates that your face was captured successfully. Click Continue. A confirmation window directs you to your mobile device:

  2. On your mobile device, accept the notification prompt from the Imprivata ID app that says to verify your identity by taking a selfie (a photograph of your face).

    The camera activates, showing the live image with overlaid instructions.

  3. Follow the displayed instructions to correctly position the device to capture an image of your face.

    The app then takes the picture and reports that it is processing the image.

    If the image was captured successfully, the mobile device shows Facial biometrics – Successfully verified your identity and your computer shows Facial biometric is working.

    If the image was not captured successfully, then on your computer, in the enrollment utility, click Try again and return to Step 2.

  4. When the image is captured successfully, then on your computer, click Continue.

    For an unsupervised enrollment: the computer shows Facial biometric EPCS enrolled under Enrolled authentication methods, and you are done with this procedure:

    For a supervised enrollment: the computer displays a window for your supervisor to witness your facial biometric enrollment. Go to Supervisor Witnessing Facial Biometric Enrollment, which is required to complete the process.

For a supervised enrollment, an enrollment supervisor must witness the facial biometric enrollment for a provider.

On the You must witness this enrollment window, the supervisor can enter or review the forms of identification they verified and the comment fields if required by your organization, and then witness the enrollment by authenticating.

After that authentication, the computer shows that the facial biometric is successfully enrolled:

  • If you cannot access the Imprivata enrollment utility and the utility pop-up Status area shows Imprivata Agent disconnected, check your network connections.

  • If your mobile device does not receive notifications from the Imprivata enrollment utility on your computer, check the settings of the Imprivata ID app on your mobile device to ensure that Notifications are allowed for the app. Also, in that app, select Features and ensure that Fast Access is enabled. Disabling Fast Access also disables notifications for this app.

  • Check the settings of the Imprivata ID app on your mobile device to ensure you have version 7.4 or later.

  • Check the version of the Imprivata agent on your computer. Agent version 7.4 or later is required for supervised (witnessed) facial biometric enrollment. Agent version 7.5 or later is required for unsupervised (unwitnessed) enrollment or unsupervised deletion of a facial biometric.

  • If you are trying to do unsupervised enrollment of your facial biometric, and one of the authentication methods you are using for two-factor authentication is being rejected, then your organization may not allow that method for EPCS. Try using a different authentication method (see the list in Requirements).

  • If you are trying to do unsupervised enrollment of your facial biometric, and the Enroll facial biometric option is disabled, then you may not have an authentication method that is EPCS allowed. If you are unable to use two authentication methods that are EPCS allowed (one of which may be a password), then your enrollment must be supervised (enabled and witnessed) by an enrollment supervisor.

  • Check Imprivata Confirm ID Supported Components to ensure that facial biometric enrollment is supported for your mobile device and mobile operating system.

  • To capture an acceptable facial biometric (facial image), good lighting is very important. If your mobile device fails repeatedly to capture an acceptable facial biometric, try improving the lighting in the room where you are taking the picture or move to an area where your face is lit evenly. You can also try to remove any facial coverings, dark-tinted eyeglasses or sunglasses, or heavy-framed eyeglasses.

  • Significant changes in your facial appearance, such as growing or removing a heavy beard, may require that you delete your facial biometric and enroll a new facial biometric. To delete your facial biometric, see Deleting a Facial Biometric.

Over time, small changes in facial appearance, such as wearing or removing non-tinted eyeglasses or growing or removing a light beard, should have no effect on the facial biometric capability. However, significant changes in facial appearance, such as growing or removing a heavy beard, may require that a provider delete their facial biometric and enroll a new facial biometric. Depending on a configuration setting (specified in Requirements), a provider may be able to delete their facial biometric unsupervised or they may require a supervisor to enable the deletion.

To delete their facial biometric unsupervised, a provider follows this procedure:

  1. Log into the Imprivata enrollment utility.

  2. Under Enrolled authentication methods, select Facial Biometric.

  3. Select Remove facial biometric.

  4. Confirm the removal in the confirmation pop-up.

If during step 3 above the Remove facial biometric option is not present, then a supervisor must enable the deletion.

To enable a supervised deletion, the supervisor follows the procedure described in Supervisor Enabling Facial Biometric Enrollment, and then the provider follows the deletion procedure above, logging into the same instance of the utility as the supervisor. When the deletion is done, the supervisor does not need to authenticate again to witness the deletion. If desired, the provider can enroll a new facial biometric as described in Provider Enrolling Their Facial Biometric.

A supervisor should always be able to enable deletion of a provider's facial biometric. However, if a provider and supervisor are unable to delete a provider's facial biometric, they can contact their Imprivata system administrator, who can delete it for them. An administrator deletes a facial biometric for a provider using the Imprivata Admin Console. In that console, the administrator:

  1. Locates the Provider's user account and selects Edit user.

  2. In the user details page, under Authentication Methods, checks Delete enrollment for the facial biometric, then clicks Save on the page to implement the deletion.

This section describes how to enroll Imprivata ID on a mobile device you will use for EPCS (electronic prescription of controlled substances) using your facial biometric (facial image). This enrollment does not require a fingerprint reader or a supervisor witness, nor does it require you to still have your old mobile device if you have recently replaced it.

You can enroll Imprivata ID for EPCS using your facial biometric when you replace an older mobile device you used for EPCS with a new mobile device, so that you must enroll Imprivata ID on the new device to enable it for EPCS use.

NOTE:

You must have your mobile device with you.

Confirm with your system administrator that the Imprivata system is configured to allow unsupervised (unwitnessed) Imprivata ID enrollment, which is required for this procedure.

Requirements

  • For mobile device and mobile operating system requirements, see Imprivata Confirm ID Supported Components.

  • You must have previously enrolled your facial biometric as an authentication method, as described in Enrolling Your Facial Biometric.

  • If you have not yet installed the Imprivata ID app on your mobile device, then you must install it before or during this procedure. App version 7.4 or later is required.

  • If you recently replaced an older mobile device you used for EPCS, and if you or your mobile carrier transferred the Imprivata ID app from a backup of your old mobile device to your new mobile device, then check the version number of the app in the new device settings. If the version number is less than 7.4, upgrade the app to the latest version available. Also, the Imprivata ID app serial number changed during the app transfer to the new device, so you must enroll Imprivata ID again on the new device.

  • The computer on which you perform part of this procedure must be running the Imprivata agent, identified by the red Imprivata icon in the system tray. Agent version 7.4 or later is required.

  • Your computer and your mobile device must be connected to the Internet.

Procedure

To enroll your Imprivata ID on a mobile device for EPCS using your facial biometric:

  1. On your computer, access the Imprivata enrollment utility by clicking on the Imprivata agent icon in your computer system tray and selecting Enroll Authentication Methods.

    If this option is disabled and the utility pop-up Status area shows Imprivata Agent Connected, then the Imprivata system may not be configured to allow unsupervised (unwitnessed) Imprivata ID enrollment. See the Note above.

  2. Log into the enrollment utility.

    The app shows your enrolled authentication methods, including facial biometric, for example:

    Your enrolled authentication methods may vary from those shown.

  3. If under Enrolled authentication methods, Imprivata ID appears in a tile (rectangle) next to the Facial Biometric tile, click that Imprivata ID tile and then click the Enroll another Imprivata ID link.

    If Enroll Imprivata ID appears under Not enrolled yet, as shown in the image above, click Enroll Imprivata ID.

    The Enroll Imprivata ID window displays:

  4. If the Imprivata ID app is not yet installed on your mobile device, install it and follow the instructions shown to set a few settings in that app.

    If the app is already installed, check the settings mentioned in the image above.

  5. Also in that app, select Features and ensure that Fast Access is enabled. Disabling Fast Access also disables notifications for this app.

    Then note the serial number and token code displayed in the app.

  6. On your computer, enter the serial number and token code and click Submit.

    The following window is displayed:

  7. On your mobile device, tap on the notification shown:

    If the following display appears, click OK:

    The camera activates, showing the live image with overlaid instructions.

  8. Follow the displayed instructions to properly position the device to capture an image of your face.

    The app then takes the picture and reports that it is processing the image:

    If the image was captured successfully, the mobile device shows Facial biometrics Successfully verified your identity (or on some devices, Facial biometrics Successfully verified) and your computer shows Facial biometric is working.

    If the image was not captured successfully, then on your computer, in the enrollment utility, it says Try again, so click Take a selfie and return to step 7.

    After the image is captured successfully, your computer shows an authentication window:

  9. On your computer, enter your password to authenticate again.

    Your computer then shows that Imprivata ID is enrolled on your new mobile device and enabled for EPCS:

Troubleshooting

  • If you cannot access the Imprivata enrollment utility and the utility pop-up Status area shows Imprivata Agent connected, ask your system administrator if the system is configured to allow unsupervised (unwitnessed) enrollment of Imprivata ID. If the utility pop-up Status area shows Imprivata Agent disconnected, check your network connections.

  • If your mobile device does not receive notifications from the Imprivata enrollment utility on your computer, check the settings of the Imprivata ID app on your mobile device to ensure that Notifications are allowed for the app. Also, in that app, select Features and ensure that Fast Access is enabled. Disabling Fast Access also disables notifications for this app.

  • Check the settings of the Imprivata ID app on your mobile device to ensure you have release 7.4 or later, which is required to enroll Imprivata ID on a mobile device for EPCS using your facial biometric.

  • Check Imprivata Confirm ID Supported Components to ensure that enrolling Imprivata ID on a mobile device for EPCS using your facial biometric is supported for your mobile device and mobile operating system.

  • To capture an acceptable facial biometric (facial image), good lighting is very important. If your mobile device fails repeatedly to capture an acceptable facial biometric, try improving the lighting in the room where you are taking the picture or move to an area where your face is lit evenly. You can also try to remove any facial coverings, dark-tinted eyeglasses or sunglasses, or heavy-framed eyeglasses.

  • Significant changes in your facial appearance, such as growing or removing a heavy beard, may require that you delete your facial biometric and enroll a new facial biometric. To delete your facial biometric, see Deleting a Facial Biometric.

To enroll security questions and answers:

  1. Select Answer security questions on the Imprivata Confirm ID enrollment screen.

  2. Follow the onscreen directions to choose questions that only you can answer, and provide answers to those questions.

  3. Click Done.

  4. You will receive a confirmation email after the enrollment is complete. If you receive an confirmation email for an authentication method that you did not enroll, contact your Imprivata Confirm ID administrator immediately.

To create your Imprivata PIN:

  1. Select Create your Imprivata PIN on the enrollment screen.

  2. Follow the onscreen directions to choose a PIN of the proper length and containing the specified allowed characters.

  3. Click Done.

  4. You will receive a confirmation email after the enrollment is complete. If you receive an confirmation email for an authentication method that you did not enroll, contact your Imprivata Confirm ID administrator immediately.