Healthcare interoperability is a multidimensional puzzle with many complex pieces – not the least of which are patient identity and matching. This topic was the focus of our recent panel session “The Identity Issue: What’s New in Patient Identity and Matching,” at our State of Healthcare Interoperability Virtual Summit, during which I had the pleasure of moderating a discussion with some leading minds in the field.

The conversation with Jason Barr from ID.me, Ryan Howells from the CARIN Alliance, Marc Mar-Yohana from OtisHealth, and Lindsey Hall from Veradigm, was not just insightful – it was a spotlight on the urgent need for robust identity solutions in healthcare.

Why Identity Matters in Healthcare

The consensus among the panelists was clear: Without a reliable way to identify patients with confidence, interoperability at a level that enables patients to seamlessly pull their data from various institutions remains complex and, well, not interoperable. Marc emphasized how crucial it is for patients to access their data across institutions seamlessly. The repeated and costly identity proofing events that patients will endure without an interoperable system is more than just an inconvenience. It’s a barrier to the value that apps like OtisHealth can bring to patients around the country.

Ryan tackled the industry perspective, advocating for a standardized level of identity proofing. The move towards a consensus on assurance levels, particularly the adoption of IAL2 from NIST SP 800-63A, is a step towards federation based on mutual trust and recognition. Interoperability across health systems is a technical challenge for sure. But technologies exist to fill that gap today, like protocols such as UDAP Tiered OAuth.

Ryan’s point was that technology is rarely the longest pole in the tent, and that same pattern is true for patient identity too. Everyone participating in a federated ecosystem has to land on the same assurance levels and technology choices in order to have interoperability. One of the panelists drew a comparison to drivers licenses being accepted across states and the federal government. States agreed to interoperate with other state’s driver’s licenses long ago out of necessity. State citizens drive across state borders often, sometimes multiple times a day. Later, the Real ID act set a common bar that all drivers licenses must be issued at a certain level in order for the federal government to rely on those licenses to get access to certain services. Services such as federally regulated transportation managed by the Transportation Security Administration. Services that every day Americans deeply value.

This is the correct analogy for identity in healthcare too. We don’t need to rip and replace all of the infrastructure on which identity is predicated. Mere consensus on standards that we already have is enough. Similar to how Real ID didn’t rip and replace all state driver licenses. Rather, it enabled the licenses to be issued in a consistent manner across states. Changes were needed and at the time they may have seemed significant, but the reality is. Someone who isn’t in the know probably would look at two driver licenses, one pre-Real ID and one post Real ID and say… “yep, those are drivers licenses.”

Convenience and Ease of Use: The Hallmarks of a Good Identity Provider

Jason brought the importance of convenience in identity solutions to the table. That sentiment was echoed by Lindsey and Marc, representing both the EHR, digital health app and customer viewpoints. Jason also gave a nod to ID.me’s implementation of the federated identifier from NIST SP 800-63C. He highlighted the feature as a potential pathway to better patient matching. Such an approach closely resembles the approach that FAST has been working on in the HL7 Interoperable Digital Identity and Patient Matching IG.

The Unspoken: Price and Business Models

One aspect we didn’t have time to delve into is the financial model underpinning these identity solutions. The current approach, where identity providers require separate business relationships with each entity that rely on their credentials, is slow to scale and not interoperable. This type of business model is contrary to a model where an identity can be asserted to a healthcare provider without any prior relationship with that organization. Such an approach allows the patient’s digital identity to break free of the identity provider’s network.

What we need is a model like the one adopted by DirectTrust Accredited HISPs, where trust is federated, and there’s no charge from the sending HISP to the receiving HISP for direct messages. The respective institutions may be charged a small fee for asserting or relying on the identity, but no business relationship is required between organizations aside from the relationship afforded by the DirectTrust network. Such a model for identity providers would allow healthcare identity systems to scale effectively.

Looking Ahead

This multi-faceted panel discussion might be over, but the conversation is just getting started. It’s evident that for healthcare interoperability to progress, the industry must embrace identity solutions that are not only secure and reliable but also convenient and financially viable. As we move forward, let’s take the insights from the panelists and use them to build a healthcare system that is truly connected, because at the end of the day, it’s about providing patients with the best care possible.


This post was contributed by Kyle Neuman, Director of Trust Framework Development.