Epic Witness Authentication Using Face Recognition

Applies to iOS devices only.

NOTE:

This feature is supported in MAM 7.4 and later.

Configure the integration between MAM and Epic Rover to support witness authentication for the administration of medication.

When used with Epic Rover, a second user authenticates using face recognition during the witness signing workflow to record authorization in the Medication Administration Record (MAR).

Epic is a registered trademark of Epic Systems Corporation.

Clinical Workflow

The following describes the clinical workflow for witness authentication:

User 1 handing mobile device to user 2

User 1 is authenticated into Epic Rover using Imprivata Locker on the iOS device.

User 1 uses the medication order workflow in Epic Rover, which requires that a second user (User 2) witness and sign off on a medication order.

User 1 hands the mobile device to User 2.

Mobile device with EHR workflow for medication order

User 2 validates that the medication order information is correct, and taps Sign Off in the Epic Rover interface.

Imprivata Locker prompts user 2 for face recogntion as the witness

Imprivata Locker prompts User 2 to authenticate using a capture of their face.

If face recognition is not available, Imprivata Locker allows User 2 to enter a username and password by tapping Use another method.

Imprivata Locker authenticates User 2.

User 2's face is accepted as the authentication method

User 2 taps Submit to complete the medication order in Epic Rover.
Medication order is complete. User 2 hands device back to User 1.

User 2 hands the mobile device back to User 1.

User 1 continues to use Epic Rover.

Before You Begin

Before you begin:

Considerations

Review the following considerations for this feature:

  • Face recognition is not supported with offline mode.

  • Biometric data is not stored on the device.

  • Face recognition supports face masks.

    BEST PRACTICE:

    To ensure the highest quality possible, the initial enrollment of a user's face should be done without a mask.

    Subsequent authentications can be done with a mask.

  • Configure the EAM workflow policy for "witness authentication for mobile" to use password as an authentication method in addition to face. If the witnessing user cannot authenticate with face recognition, they can tap Use Another Method in the Locker interface to enter their username/password.

Limitations

  • Face recognition takes priority over password when both are configured.

    A witness who prefers password cannot skip past the face prompt; they must wait for face to fail (or be unenrolled) for the password screen to appear.

  • Proximity card authentication is not supported on Locker iOS for the witness step.

    Administrators can include proximity card authentication methods in the workflow for other Imprivata mobile clients, but Locker iOS 4.4 will not honor them. Configure face and/or password to ensure Locker iOS witnesses can complete the workflow.

  • Imprivata PIN is not a supported fallback in this release. The only non-biometric option on Locker iOS 4.4 is Imprivata username and password.

  • Witness identity is not checked against the primary user. Locker iOS does not block a user from witnessing their own checked-out session. Sites that require a distinct witness must enforce that policy through Epic Rover configuration or clinical practice, not through Locker.

  • One-to-many face matching is not supported. The witness must identify themselves (Locker uses the face check to verify, not to identify).

  • Trusted-device shortcuts do not apply to the witness step. A witness must authenticate each time, even on a device the witness has previously used.

Requirements

Take note of the requirements for this feature:

  • Imprivata Licensing: Face recognition authentication requires an Authentication Management license and a Confirm ID for Clinical Workflows license.

  • Imprivata appliances running EAM 26.2 and later. If your appliances are running an earlier release, upgrade them to EAM 26.2 and later. See the Imprivata Upgrade portal.

  • MAM server and Launchpads running 7.4 and later.

  • Imprivata Locker app requirements:

    • iOS — Imprivata Locker for iOS 4.4 and later.

  • The user must grant access to the device's camera to use face recognition.

  • In EAM, Epic witness authentication requires two profiles created and assigned to the Epic Rover app:

    • An SSO application profile for first user authentication.

    • Witnessing profile for the second user to use face recognition in the Epic witnessing workflow. This policy must contain password and face as authentication methods.

  • In EAM, create a workflow policy for the witnessing workflow and associate it with the user policy assigned to the witnessing users.

Configure Epic Witness Authentication

Perform the following tasks to configure witness authentication for Epic Rover.

Configure EAM Single Sign-On Application Profiles

To create the two application profiles for witnessing:

  1. In the Imprivata Admin Console, go to Applications > Single sign-on application profiles.

  2. Click Add App Profile > Application using OpenID Connect. The Add application using OpenID Connect page opens.

    1. Give the Epic Rover application profile a name. This name is only visible to administrators.

    2. Give the Epic Rover application a user-friendly name. This is the application name your users will see when they log in.

      For example: Epic Rover OIDC.

    3. Enter Redirect URIs from the RP. If you do not have them yet, leave this window open and go to the RP's admin console in another window.

    4. Optional: Claims — Review the default claims, and configure any custom claims required for your integration.

    5. Generate Client credentials to provide to the RP.

    6. Generate IdP Metadata to provide to the RP.

    7. Click Save.

  3. Repeat steps 2a through 2g to create an app profile for the witnessing workflow.

    For example: Epic Rover Witness OIDC.

  4. Deploy the two app profiles to the appropriate users and groups.

Create and Assign User Policy for Witness Authentication

Create a user policy for witness authentication and associate it with a mobile device workflow for witnessing.

To create a user policy:

  1. In the Imprivata Admin Console, go to Users > User policies.

  2. On the User policies page, click Add.

  3. Enter a name for the user policy. For example: Epic Rover Witness.

  4. In Primary factors, select Password, then select Face recognition.

  5. Go to Users > Workflow policy.

  6. In the Mobile device workflows > Mobile Witnessing Authentication section, select Face recognition and Password.

  7. Click Associate user policies and select the user policy for the witnessing users.