This post has been republished via RSS; it originally appeared at: Healthcare and Life Sciences Blog articles.
The Shared Clinical Workstation (SCW) is the primary computing endpoint used by “frontline” healthcare workers to access digitized clinical processes and information. These workstations are often mounted on walls and other spaces through a patient care area, on rolling carts or in dedicated consultation rooms. Members of the clinical team use these workstations to capture and review patient information.
While the SCW is implemented in a variety of configurations, a common deployment model uses a concept called “generic autologin” to reduce time/effort required to access clinical applications. While reducing non-productive time related to technology overhead (login, user profiles, OS navigation, etc.), it introduces two major security/privacy risks:
- The SCW is sitting open where anyone, authorized or not, can walk up and use it
- Activities on the SCW operating system are not traceable to a specific user
Imprivata OneSign®, the leading healthcare enterprise single sign-on and virtual desktop access solution, reduces those risks by protecting those “generic autologin” systems. In addition, the OneSign® solution gives providers convenient and secure access to protected health information across all native workflows for all major Clinical Information Systems (EMR, CPOE, LIS, RIS, etc.).
More than ever, interdisciplinary teams deliver care, rather than autonomously by individuals. This is causing an even greater need to communicate and collaborate as a team. This, in turn, is creating demand for using any computing endpoint, especially the Shared Clinical Workstation, as a collaboration endpoint. While the combination of “generic autologin” and OneSign® has elegantly and securely solved for clinical applications, cloud applications, like Microsoft Office 365 collaboration and communication, have not functioned properly in this configuration. This limitation has historically blocked the Shared Clinical Workstation’s use as a communication and collaboration tool.
In a recent announcement, Imprivata laid out new integrations between OneSign® and Microsoft 365 (Windows 10, Enterprise Mobility + Security, and Office 365). These new integrations offer a solution for delivering both clinical applications and communication/collaboration tools to Shared Clinical Workstations. This solution is a result of a new partnership between Microsoft and Imprivata. The goal of the partnership is to deliver an architecture and capabilities for Modern Shared Clinical Workstations.
Solution Overview
The solution to delivering both traditional and cloud applications to Shared Clinical Workstations essentially enables Integrated Windows Authentication for Azure AD protected applications by leveraging recent updates to the Microsoft and Imprivata platforms. This allows a single authentication by Imprivata OneSign (a badge tap, for example) to provide access to all the healthcare applications that Imprivata supports today and to Microsoft first-party cloud applications and to the thousands of SaaS applications available in Azure AD catalog.
Beginning with Imprivata OneSign 6.2, the ISXRunAs command line utility (ISXRunAs.exe) is installed with the Imprivata agent. This utility allows an authenticated user to launch and run an IWA enabled application under their user profile, instead of the local (generic) Windows user on the shared workstation. This enables access to network resources, such as mapped drives and network printers, from within the application. When paired with the recently available Seamless SSO configuration of Microsoft Azure Active Directory and hybrid Azure AD joined PCs, the ISXRunAs also provides access to Azure AD-integrated applications such as O365 and Azure AD connected 3rd party SaaS applications.
Requirements
- Imprivata OneSign Appliance 3rd Generation running 6.2 or later
- AADConnect with PWHash and Seamless SSO or Pass-through Authentication configured
- Windows 10 (tested on 1809 but all versions should work)
- Hybrid Azure AD Joined PC
- Imprivata Agent downloaded to PC from the virtual appliance
- User must be a part of the AD domain
Solution Detail
Once the environment is configured with the elements above the system will be ready for the configuration of the ISXRunAs.exe shortcut. The shortcut can be manually configured on an individual endpoint or to a targeted group via Group Policy Object (GPO). These instructions can be found in the Imprivata document Configure Integrated RunAs.
To configure a shortcut on a single endpoint follow the instructions below:
- Go to the
- 32–bit — C:\Program Files\Imprivata\OneSign Agent
- 64–bit — C:\Program Files (x86)\Imprivata\OneSign Agent
- Right–click ISXRunAs.exe, and select Send to > Desktop (create shortcut)
- Go to the desktop, and right–click ISXRunAs - Shortcut
- Update the Target field to include the addi?onal ISXRunAs usage parameters.
- Click OK
Examples:
Outlook on the Web shortcut Target:
"C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" "C:\Program Files (x86)\Internet Explorer\iexplore.exe" "https://outlook.office.com"
Teams full client shortcut Target (web app recommended, but full client also works):
"C:\Program Files (x86)\Imprivata\OneSign Agent\ISXRunAs.exe" /profile "C:\Users\administrator.MSPMTC\AppData\Local\Microsoft\Teams\update.exe" --processStart "teams.exe"
The end user experience would be to use the provided shortcuts on the desktop. This is generally how healthcare applications are provided via a technology such as Citrix, surfaced to clinical workers as shortcuts to published applications. These shortcuts for productivity and 3rd party SaaS applications would just be additional apps on the clinical worker desktop creating no change to the current application launch experience. These applications can also be configured for auto-launch upon badge tap through the OneSign Agent.
See Also the detailed breakdown of the solution along with an excellent demo video produced by our MTC and TSP teams.