Imprivata Confirm ID Authentication Methods

Hands Free Authentication automatically and securely retrieves a one-time password (OTP) from the provider's device to authenticate when signing electronic prescription orders. The OTP, which is generated every 30 seconds by the Imprivata ID app, is validated over an encrypted, low-energy Bluetooth connection between the endpoint computer and the provider's device. This workflow results in minimal disruption to the clinical workflow, as the provider does not have to touch or handle the device.

For complete information, see Hands Free Authentication for Imprivata Confirm ID.

Licensing Hands Free Authentication to Some or All Imprivata ID Users

Hands Free Authentication is an available licensed option for some or all of your Imprivata ID users.

In a user policy, go to the Authentication tab > Licensed options. Imprivata ID is not a licensed option per se, but the checkbox Hands Free Authentication controls whether the users in this policy can use Hands Free Authentication with their Imprivata ID:

• User policy with Hands Free Authentication license — Hands free authentication, Push authentication, and manual entry of one time password available.
• User policy without Hands Free Authentication license — Push authentication, and manual entry of one time password available.

Imprivata ID Push Authentication

During the Remote Access or Imprivata ID for Windows Access workflow, the user can still authenticate with the Imprivata ID app even though his mobile device is outside your enterprise network. A notification is sent to the user's device to authenticate; he can accept or reject the authentication by pressing the notification, then accepting or rejecting. The low-energy Bluetooth connection between the Imprivata ID app and the Imprivata agent is not required.

Imprivata ID with Symantec Tokens

Imprivata Confirm ID supports authentication with Symantec tokens in the Imprivata ID app. For complete information, see Hands Free Authentication for Imprivata Confirm ID.

The Remote Access workflow supports SMS text notifications to any iOS or Android device that accepts SMS messaging, including devices not supported by Imprivata ID. With SMS text notifications, the user receives a code on his device, and enters the code on his computer to authenticate during the Remote Access workflow.

Imprivata and Symantec have partnered to provide OTP tokens for e-prescribing controlled substances. Before Symantec VIP Credentials can be enrolled, you need to configure the connection between Imprivata and Symantec.

Symantec VIP Credentials can be managed from the Symantec VIP Credentials page.

When you first install the Imprivata agent, all users are authorized for password authentication. The default username and password are the user's current user directory credentials.

You can disallow password authentication for some or all users via user policy; however, all enabled users must have at least one authentication method. Password authentication is often used as a second factor for two-factor authentication.

There is no separate enrollment step for password authentication. All users automatically enroll the first time they log into Windows after installing the Imprivata agent.

Password Authentication for Imprivata Confirm ID

Imprivata Confirm ID users can always log into the Imprivata Confirm ID enrollment utility using their username and network password.

Password authentication for signing workflows must be enabled per each supported workflow in the Imprivata Confirm ID workflow policy.

Imprivata fingerprint verification allows users to enter their login credentials while adding a layer of security by verifying their identity through a fingerprint scan. This is a "one-to-one" verification as Imprivata checks the fingerprint against the credentials provided by the user.

Imprivata supports passive proximity card authentication with most standard proximity cards and USB card readers from RF IDeas Inc. Proximity card authentication can be combined with password, Imprivata PIN (as an alternative to a password), or finger biometrics as second factors to provide strong two-factor authentication.

See Configuring Passive Proximity Card Authentication

Imprivata includes built-in RADIUS integration to Secure Computing’s Premier Access and Remote Access Servers and RSA's Authentication Manager for token authentication. Imprivata can provide a seamless single-step desktop login using two-factor one-time passcodes for logging in to any SSO-enabled client/server, web, or legacy application from any Imprivata-enabled desktop. ID token-enabled users authenticating to Imprivata use their domain usernames instead of their ID token system usernames (these may be the same values). In all other ways Imprivata makes no changes to the user experience.

Before users can use an ID token to authenticate, you need to configure a connection to the ID token server. See Configuring External OTP Tokens.

These are global settings for the entire Imprivata enterprise. You can override these settings locally for specific site, as detailed in Overriding an ID Token Server Connection.

Imprivata provides support for VASCO (now known as OneSpan) OTP tokens out-of-the-box. Imprivata embeds VASCO's VACMAN middleware and management components within the Imprivata appliance. There is no separate token management server to purchase or maintain.

You can manage VASCO OTP tokens on the VASCO OTP tokens page of the Imprivata Admin Console (Devices menu > VASCO OTP tokens)

For more information, see Managing VASCO OTP Tokens

When security questions are enabled as an authentication method, users enroll security questions that they can later answer to authenticate in signing workflows. See Configuring the Workflow Policy for complete details.

You can set different security questions with different settings for different user policies. When you create a new user policy with emergency access privileges, the new policy uses the settings in the default policy as a starting point.

See Configuring Authentication Methods in User Policies for information about configuring options for security questions.