Common Clinical Workstation and Mobile Workflows

Clinical Workflows

Clinical workstations refer to desktop computing platforms running Microsoft Windows or lightweight operating systems used to remotely connect to virtualized applications and desktops. They can generally be grouped into two main categories:

  • Shared workstations

    Shared workstations, often called kiosks or public workstations, are commonly used in areas where many different users require fast access to clinical applications for a limited period of time. Electronic prescribing and approval workflows may also be commonly encountered on these workstations. ,These workstations are typically found in patient rooms, exam rooms, nursing stations, and physician documentation areas.

  • Private workstations

    Private workstations are commonly used by a single user who requires access to one or more applications for a prolonged period of time. These workstations are typically found in a private location, administration area, or specialty areas such as radiology.

The following table provides a summary of workstation configurations and the common clinical setting for which they are suited.

Workstation Configuration

Common Clinical Setting

Shared with Epic EHR

Used in settings where there is direct interaction between the patient and the provider.

For example – exam rooms or inpatient rooms.

Shared with roaming applications

  • Used in most clinical settings.

  • Not recommended for settings where the patient record must remain persistent on the workstation for different users to access, such as in an exam room setting.

Shared with roaming virtual desktop

  • Used in most clinical settings.

  • Not recommended for settings where the patient record must remain persistent on the workstation for different users to access, such as in an exam room setting.

Private workstation

Used in a private location, administration area, or specialty areas (such as radiology) where a limited number of users require access.

For example – a physician office or loung , or an administration area that is only used by unit coordinators.

Expand a section below to learn more about the clinical workflow and the recommended reference architectures.

Mobile Device Workflows

Clinical mobility can generally be grouped into three main categories:

  • Shared mobile devices

    Devices owned and managed by the institution using Mobile Device Management that are commonly used in areas where many different users, primarily nurses, EVS, and ancillary services, utilize a common supply of mobile devices for set periods of time, often shift based. These devices are typically checked out of a central location on each unit or floor, but then utilized across the entire facility including but not limited to patient rooms, exam rooms, nursing stations, and physician documentation areas. The devices are managed by Mobile Device Management.

  • Single user mobile devices

    Devices are owned and managed by the institution using Mobile Device Management and used perpetually by a single user both inside and outside the hospital, most commonly by physicians.

  • Clinician owned devices (BYOD)

    Privately owned devices, often purchased by the individual and used by a single user both inside and outside the hospital.

The following table provides a summary of mobile device configurations and the common clinical setting for which they are suited.

Workflow

Common Clinical Setting

Shared mobile devices

Used throughout every major venue of the hospital from EVS staff to laboratory to bedside patient care environments

Expand a section below to learn more about the clinical workflow and the recommended reference architectures.

The shared workstation with Epic EHR configuration gives users fast access to the workstation and the EHR:

  • The EHR is not closed on user switch.

  • Other applications, such as web browsers and email, are closed on user switch.

  • Typically used in locations where there is direct patient-provider interaction, such as in exam rooms and inpatient rooms.

Clinical Workflow

The following describes the workflow:

User 1 (nurse) taps their proximity card to authenticate to a shared workstation that is secured by Imprivata Enterprise Access Management.

  • The Epic EHR is already running (persistent), and the nurse is automatically signed in.

  • The nurse may choose to open additional applications, which can be configured for SSO, if required.

When the nurse is finished, they tap their proximity card to secure the workstation. All of the applications that were in use by the nurse remain running, including the Epic EHR, but are now secured behind the Imprivata lock screen.

User 2 (physician) taps their proximity card to authenticate to the shared workstation.

  • All of the nurse’s applications are closed and the Epic EHR is automatically signed in as the physician.

  • The physician may choose to open additional applications, which can be configured for SSO, if required.

The physician may need to electronically prescribe medications or sign off on attestation workflows with the EHR using single- or multifactor authentications.

Using Imprivata Enterprise Access Management, the most efficient authentication options are presented to the physician, depending on the specific workflow requirements, the physician's enrolled authentication methods, and the authentication methods available at that workstation.

When the physician is finished, they tap their proximity card to secure the workstation. All of the applications that were in use remain running, including the Epic EHR, but are secured behind the Imprivata lock screen.

The physician returns to the same workstation, during a period of time in no other users have authenticated to that workstation, and taps their badge.

The physician has immediate access to all of the applications that were previously being used, including the Epic EHR.

Reference Architectures

You can implement this workflow on Windows workstations, as well as thin and zero client endpoints.

  • Windows

    In environments with Windows–based workstations, Epic is typically delivered to the desktop via an application virtualization technology.

    For example – Citrix DaaS.

  • Thin or zero client

    In environments with thin or zero clients, there are three options for delivering Epic to the desktop.

    • Option 1 — With this option, the Epic client is installed to a virtual desktop, and the endpoint is configured to maintain a persistent connection with the desktop. This is also known as a single hop.

    • Option 2 — With this option, there is a persistent VDI connection. However, Epic is delivered to the virtual desktop via an application virtualization technology.

      For example — Citrix DaaS. This is also known as a double hop.

    • Option 3 — With this option, there is a virtual application connection where Epic is delivered directly to the thin or zero client via an application virtualization technology.

NOTE: For information about the technology and a summary of the configurations, see Shared workstation with Epic EHR.

The shared workstation with roaming applications configuration lets users move from workstation to workstation and automatically connect to one or more applications, including the Epic EHR:

  • The applications are delivered via application virtualization technology.

  • As a clinician authenticates to different shared workstations, they reconnect to their application virtualization session.

    This makes it appear as if the applications are "roaming" with them.

  • The Epic EHR will either have closed all non-roaming enabled activities or completely restarted.

  • Can be used in most clinical settings. It is not recommended for settings where the patient's medical record needs to remain persistent on the workstation for different users to access, such as in an exam room.

Clinical Workflow

The following describes the workflow:

User 1 (physician) taps their proximity card to authenticate to a shared workstation that is secured by Imprivata Enterprise Access Management.

  • The roaming applications, including the Epic EHR, are automatically launched for the physician.

  • The physician is automatically signed in to the applications.

When the physician is finished, they tap their proximity card to secure the workstation. Securing the workstation disconnects the roaming applications from the workstation.

The physician continues their rotation, moving to a new floor. They tap their proximity card to authenticate to a different shared workstation.

  • The roaming applications, including the Epic EHR, are automatically reconnected to the workstation.

  • The non-Epic applications are in the same state as they were when the physician last used them at the previous shared workstation.

  • The Epic EHR will either have closed all non-roamin enabled activities or will have completely restarted (depending on whether Roaming is enabled within Epic Hyperdrive).

The physician may need to electronically prescribe medications or sign off on attestation workflows with the EHR using single- or multifactor authentications.

Using Imprivata Enterprise Access Management, the most efficient authentication options are presented to the physician, depending on the specific workflow requirements, the physician's enrolled authentication methods, and the authentication methods available at that workstation.

When the physician is finished, they tap their proximity card to secure the workstation. Securing the workstation disconnects the roaming applications from the workstation.

User 2 (nurse) taps their proximity card to authenticate to the same shared workstation that the physician was using.

  • The nurse’s roaming applications, including the Epic EHR, are automatically launched.

  • The nurse is automatically signed in to the applications.

Reference Architectures

You can implement this workflow on Windows workstations, as well as thin and zero client endpoints.

  • Windows

    In environments with Windows-based workstations, Epic is typically delivered to the desktop via an application virtualization technology.

    For example – Citrix DaaS. Citrix can be configured to support application auto launching and roaming.

  • Thin or zero client

    Some non–Windows based thin or zero clients support application auto launching and roaming without first requiring a connection to a full Windows desktop.

NOTE: For more information about the technology and a summary of the configurations, see Shared Workstations with Roaming Applications.

The shared workstation with roaming virtual desktop configuration lets users move from workstation to workstation and automatically connect to a full Windows desktop, which is is delivered via VDI technology. As a clinician authenticates to different shared workstations, they reconnect to their desktop virtualization session.

  • This makes it appear as if the desktop, and all the applications that are running within it, are “roaming” with them.

  • Can be used in most clinical settings. It is not recommended for settings where the patient's medical record needs to remain persistent on the workstation for different users to access, such as in an exam room.

Clinical Workflow

The following describes the workflow:

User 1 (physician) taps their proximity card to authenticate to a shared workstation that is secured by Imprivata Enterprise Access Management.

  • The roaming virtual desktop is automatically launched for the physician.

  • The physician is automatically signed in to the desktop and any applications that are enabled for SSO, including the Epic EHR.

When the physician is finished, they tap their proximity card to secure the workstation. Securing the workstation disconnects the roaming desktop from the workstation.

The physician continues their rotation, moving to a new floor. They tap their proximity card to authenticate to a different shared workstation.

  • The roaming virtual desktop is automatically reconnected to the workstation.

  • The desktop and the applications are running are in the same state as they were when the physician last used them at the previous shared workstation.

  • The Epic EHR will either have closed all non-roamin enabled activities or will have completely restarted.

The physician may need to electronically prescribe medications or sign off on attestation workflows with the EHR using single- or multifactor authentications.

Using Imprivata Enterprise Access Management, the most efficient authentication options are presented to the physician, depending on the specific workflow requirements, the physician's enrolled authentication methods, and the authentication methods available at that workstation.

When the physician is finished, they tap their proximity card to secure the workstation. Securing the workstation disconnects the roaming desktop from the workstation.

User 2 (a nurse) taps their proximity card to authenticate to the same shared workstation that the physician was using.

  • The roaming virtual desktop is automatically launched for the nurse.

  • The nurse is automatically signed in to the desktop and any applications that are enabled for SSO, including the Epic EHR.

Reference Architectures

Although Windows-based workstations can support virtual desktop roaming workflows, non–Windows-based thin or zero clients are becoming more commonly used for full desktop roaming. There are two options for delivering Epic to the virtual desktop:

  • Option 1 — With this option, the Epic client is installed directly on the virtual desktop image.

  • Option 2 — With this option, Epic is delivered to the virtual desktop via an application virtualization technology.

    For example — Citrix DaaS. This is also known as a double hop.

NOTE: For more information about the technology and a summary of the configurations, see Shared Workstation with Roaming Desktop.

The private workstation configuration is typically dedicated to a single user throughout an entire shift. The user accesses a full Windows desktop and uses locally installed applications, as well as applications that are delivered via application virtualization technology.

This configuration is commonly used in private/physician offices, shared offices with limited repeat users, for unit coordinators, and in specialty areas such as radiology.

Clinical Workflow

The following describes the workflow:

A user taps their proximity card to authenticate to a private workstation that is secured by Imprivata Enterprise Access Management.

  • The Windows logon process completes, and the user can open one or more applications, including the Epic EHR.

  • Any of these applications can be configured for SSO.

When the user is finished, they tap their proximity card to secure the workstation. Unlike shared workstation configurations, only the user who locked the workstation can unlock it.

The user returns to the private workstation, and taps their proximity card to authenticate.

  • The workstation is unlocked.

  • The desktop and the applications that are running are in the same state as they were when the physician last used them.

The physician may need to electronically prescribe medications or sign off on attestation workflows with the EHR using single- or multifactor authentications.

Using Imprivata Enterprise Access Management, the most efficient authentication options are presented to the physician, depending on the specific workflow requirements, the physician's enrolled authentication methods, and the authentication methods available at that workstation.

When the user is finished using that workstation for the day, they should shut down all applications and log off.

Reference Architectures

In environments with Windows–based workstations, Epic is typically delivered to the desktop via an application virtualization technology. For example — Citrix DaaS.

NOTE: For information about the technology and a summary of the configurations, see Private Workstation.

To complete an order for controlled substances, physicians must use two factor authentication as required by the United States Drug Enforcement Agency (DEA). This task is often completed within the health system on a clinical workstation, however there are a certain subset of physicians where it makes sense to allow EPCS on a mobile device.

The allowed factors for authentication include a combination of two of the three categories:

Clinical Workflow - EPCS on a Clinical Workstation

The physician navigates to the Order Entry section of Epic and places their controlled substance order.

The physician is prompted to complete two factors of authentication to confirm the order is appropriate. Imprivata Enterprise Access Management prompts the user for two factors of authentication based on enrollment status and the most convenient options that are available on the clinical workstation.

NOTE: A proximity card is not recognized by the DEA as an acceptable form of authentication for EPCS.

After the order is complete, it is sent electronically to the appropriate pharmacy for fulfillment.

Clinical Workflow - EPCS on Epic Haiku or Canto

For a subset of physicians, it makes sense to complete controlled substance ordering from their mobile devices.

Controlled substance orders can be sent from Epic Haiku or Canto on a physician's personal Android or iOS device.

The Mobile EPCS license also allows providers who sign off on EPCS orders from their workstations to leverage facial biometrics to avoid another supervised enrollment and self-enroll a new Imprivata ID app on a new or replacement iOS device.

The physician navigates to the Epic application Haiku on their mobile Android or iOS device, or Canto from their iOS tablet.

An order for a controlled substance is placed. The physician is prompted to enter their password as the first form of authentication.

The physician is prompted to enter their one-time password (OTP) from their hard token.

After the order is completed, it will electronically be sent to the appropriate pharmacy for fulfillment.

For security and safety, Epic has enabled multiple workflows that require a user to reauthenticate with their credentials to complete a task. Without Imprivata, this is completed by entering their Epic password. This causes end-user frustration and takes time away from their patients. Imprivata enables users to tap their badge or use their fingerprint (as well as many of the authentication methods ) to reauthenticate to more than sixty signing workflows in Epic.

Clinical Workflow

The clinician accesses a workflow in Epic that requires reauthentication. This could be for break the glass, attestation, or a med dispense.

After completing the details of the workflow, they click the Accept button in Epic.

Imprivata Enterprise Access Management prompts the user for authentication based on enrollment status and the most convenient options that are available on the clinical workstation. Typically, the user would tap their enrolled proximity card to complete the authentication request.

For security and safety, Epic has enabled multiple workflows that require a second user to witness a transaction initiated by a first user already authenticated to Epic. Without Imprivata, this is completed by the witnessing user entering their Epic password. This causes end-user frustration and takes time away from their patients. Imprivata allows both users to tap their proximity badge or use their fingerprint to reauthenticate.

Imprivata recommends an Imprivata OneSign Fingerprint Identification (FBID) license if using a fingerprint for witnessing workflows (not needed for reauthentication workflows).

Clinical Workflow

  • The clinician accesses a workflow in Epic that requires a witnessing user to authenticate.

    This could be for a medication administration, blood administration, or cosign of an order.

  • The user that is authenticated to Epic completes the workflow in Epic and clicks Accept.

  • A second user checks the first user’s work and clicks Sign Off in Epic.

  • The second user — who is the witness to the first user’s work — is prompted by Imprivata Enterprise Access Management for authentication based on enrollment status and the most convenient options available on the clinical workstation. Typically, the user would tap their enrolled proximity card to complete the authentication request.

The Specialty Narrator in Epic is a tool used to capture attendance during critical events. The most common events are Trauma, Code, and Sedation.

By using Imprivata in the Specialty Narrator, the burden of capturing attendance is removed from the nurse orscribe in the room, allowing person to concentrate on capturing all the other critical details of the event. Imprivata allows for a badge tap to passively capture both the arrival and departure of an individual in the Narrator as they enter and exit the event respectively.

There are two common ways to configure the Specialty Narrator: Integrated and Standalone.

Clinical Workflow - Integrated Specialty Narrator

With Standalone Specialty Narrator, a dedicated workstation for clinicians registers their attendance on a pre-login screen of Epic. Clinicians approach the workstation and tap their proximity card on a reader to mark themselves as arrived or departed. This dedicated workstation can act as a hub for a group of care rooms in a department.

A standalone badge scanning workstation might be more suitable for trauma events, while integrated badge scanning might be more suitable for code or sedation events where having a separate workstation is not always feasible.

  • A user starts the Specialty Narrator event in Epic.

  • Upon arriving to the event, each attendee taps their proximity card on a dedicated workstation.

  • If there is only one event tied to the dedicated workstation, the user continues to the event. Imprivata Enterprise Access Management marks them as arrived automatically in the Specialty Narrator.

  • If there are multiple events tied to the same dedicated workstation, the user selects which event they are attending. This action will then automatically mark them as arrived. Multiple users may tap their badge in rapid succession, not creating a delay.

  • When the attendee leaves the narrator event, they tap their proximity card on the dedicated workstation, and Imprivata Enterprise Access Management automatically marks them as departed.

Clinical Workflow - Standalone Specialty Narrator

When the Staff toolbox group is used in Epic specialty Narrators, staff use a proximity card scanner to mark themselves as arrived or departed during a specialty event.

Using integrated proximity card scanning allows clinical staff to mark themselves as arrived or departed with a tap of their proximity card, so they do not have to interrupt documenting important patient care assessments and medications.

This workflow is performed on the same workstation that clinicians are already using to document patient care.

  • User 1, commonly a nurse or scribe, starts the Special Narrator event in Epic.

  • After the event has started, the user can actively document events as they occur (LDA, Medication, Vitals, etc.).

  • Each attending member of the event taps their proximity card on the reader of the scribe’s clinical workstation as they enter the area/room where the event is occurring.

  • Imprivata Enterprise Access Management seamlessly marks the attendee as arrived, without disrupting the workflow of the scribe.

  • As attendees leave the area/room where the event is occurring, they again tap their proximity cards on the reader of the scribe’s clinical workstation.

  • Imprivata Enterprise Access Management automatically marks them as departed from the event.

  • If an attendee fails to tap their proximity card, they are automatically marked as departed from the event when the scribe ends the Specialty Narrator event in Epic.

Shared mobile Apple iOS and Android devices are often allocated to units or departments and stored in a shared space for daily/shift-based assignment. These devices allow clinicians to have fast and secure access to mobile applications including Epic Rover and clinical messaging systems. With Rover, clinicians can record documentation in a patient’s chart and perform other tasks, including medication administration, at the point of care from a handheld device.

  • A clinician typically obtains a shared mobile device at the beginning of their shift, and they are required to authenticate to installed mobile applications, including Rover, using usernames and passwords.

  • The applications need to remain logged in and active for the duration of the clinician’s shift, or for as long as the clinician requires access to the mobile device.

  • When the clinician is finished using the mobile device, they need to log out of all the mobile applications and return the device to a charging station where it can be available for the next user.

Using Imprivata Mobile Access Management (formerly GroundControl) with Imprivata Enterprise Access Management integration, the retrieval from inventory, the use, and return to inventory processes for shared mobile devices is streamlined.

Clinicians tap their proximity card on a reader connected to a mobile device smart hub to rapidly provision a device for their use. Integration with Imprivata Enterprise Access Management provides credential autofill for mobile applications running on the device, including Rover. At the end of their shift, the clinician returns the mobile device to the smart hub, which automatically closes Rover and other applications and removes any personalization settings and recharges the device for the next user.

This configuration is typically used in locations where there is direct patient-provider interaction such as in exam rooms and inpatient rooms.

Clinical Workflow

  • The user taps their proximity card on a reader that is connected to a mobile device smart hub managed by Imprivata Mobile Access Management. Smart hubs are used to centrally charge and manage 8to 24 shared mobile devices.

  • The mobile device is personalized within a few seconds and is configured with the appropriate applications.

  • The user retrieves the device from the smart hub and is prompted to set a device-level PIN (facility operational dependency).

  • The user launches one or more mobile applications, including Epic Rover, and they click the iOS keychain icon to allow MAM to autofill application-specific usernames and passwords.

  • The user secures the mobile device by enabling the iOS lock screen.

  • If the device is left inactive for a specified amount of time, the device will secure automatically. When secured, all the applications that were in use by the nurse remain logged in, including Epic Rover.

  • The nurse unlocks the device using the PIN set during device provisioning and resumes use of the applications that are already running.

  • At the end of their shift, or when the mobile device is no longer needed, the user returns the device to the smart hub.

    • This automatically closes Rover and other applications.

    • Any personalization settings are removed from the device, and it is recharged and made available for the next user.

For information on the technology and high-level configurations required to support shared mobile device workflows, see the reference architecture for Shared Mobile iOS device with Epic Rover.