Mobile EPCS — Face Migration

This topic describes replacing legacy support for Mobile EPCS Face Recognition with the new Imprivata Cloud Platform (ICP) Face Recognition support.

This process is only required for:

  • Customers who have enrolled clinicians in Face recognition for Mobile EPCS authentication, and

  • The clinicians enrolled for Face Recognition with Imprivata EAM 25.3 or earlier.

This process is not required for:

  • Enterprises who have only enrolled their end-users in Face Recognition for any other Imprivata EAM workflow, for example, Desktop Authentication.

NOTE:

This process is intended to migrate face enrollments in bulk. Alternatively, you can choose to require your currently-enrolled clinicians to re-enroll for face recognition at the Imprivata enrollment utility.

Before You Begin

  • Upgrade Appliances to Imprivata EAM 25.4 or later — Ensure you have installed the proper Enterprise Access Management release containing the migration feature

    In the Imprivata Admin Console, click the (?) icon to confirm the installed release.

  • Upgrade Mobile App to the latest release of the Imprivata ID Mobile EPCS client.

  • Imprivata Access Management — Ensure the Imprivata appliance is configured for Imprivata Access Management integration. In the Imprivata Admin Console, see the Imprivata cloud services status panel. Confirm Access Management integration is running. For details on this connection, see Secure Connection To Imprivata Cloud Platform.

  • Imprivata Cloud Connect — In the Imprivata cloud services status panel, ensure the Cloud connection between the Imprivata appliance and ICC is running. For details on this connection, see Secure Connection To Imprivata Cloud Platform.

  • Sync your users from Entra ID to the Imprivata Cloud Platform. Detailed instructions are available here.

  • Firewall — Ensure your firewall is configured to allow communication between the Imprivata appliance and the production cloud environment. The following hosts should be permitted:

    • cloud.imprivata.com

    • sys.imprivata.com

    • app.imprivata.com

    For details, see About Outbound Communications.

Install the Custom IPM

To download the Face Authentication Migration IPM file, visit the product downloads page at https://community.imprivata.com/s/product-downloads.

To distribute and install the custom IPM:

  1. Log into the Imprivata Appliance Console. Go to the Packages tab.

  2. Click Upload Imprivata Package, specify the custom IPM file, and then click Upload.

  3. Click Distribute, and then Send, to copy the IPM to all appliances in the enterprise.

  4. Click Done when the distribution is finished.

  5. From the Imprivata Appliance Console, select the IPM and click Install. The IPM Information page appears and Install IPM on all appliances is selected.

  6. Click Install.

After this IPM is installed:

  • The Imprivata Admin Console > Imprivata Access Management integration page will now display a new migration section Migrate Facial Biometric Enrollments.

  • The enrollment utility will no long allow clinicians to enroll faces with the legacy method.

Run The Migration

  1. Enable debug logging, this is critical for troubleshooting, if needed. See Managing System Settings.

  2. In the Imprivata Admin Console > Imprivata Access Management integration page, go to Migrate Facial Biometric Enrollments, and click Run Migration.

    Check back later for progress.

  3. When the migration is completed, you will see a status report of the migration displayed.

  4. If the migration did not complete successfully, follow the instructions displayed onscreen, and/or contact Imprivata support.

Confirm the Migration Succeeded

Besides the message displayed on the  Imprivata Access Management integration page, you can also confirm the migration succeeded as follows:

  • View a User Details page > Face recognition to confirm EPCS is enrolled.

  • View the audit CSV report for the Activity: User Facial Biometric Enrollment Migration Result: Successful

  • Perform a signing with Mobile EPCS — the clinician should be seamlessly authenticated using the newly migrated Imprivata Cloud Platform facial biometric. To ensure the server does not "fall back" to authenticating with the legacy face enrollment, delete their legacy enrollment before this test.

  • View server logs to confirm a successful migration. See Imprivata Appliance Logs

If the migration was successful and all faces were migrated, uninstall the custom IPM.