Challenges and opportunities in achieving secure hospital clinical mobility management: An illustrative use case

The IoMT has rapidly increased the number of connected devices and applications in healthcare, while also increasing care efficiency. It’s expected that the number of IoMT devices globally will grow 131% by 2026.^[2] Mobile devices can help facilitate and optimize the expanding IoMT by streamlining many workflows at the point of care, which enables faster secure real-time transfer of patient data and access to the connected network.

When HDOs enable clinicians to engage workflows extending beyond the primary organizational footprint, it is essential that information security/privacy are in place protecting everywhere staff accesses confidential data/information. To securely deliver the needed features of mobile technology, HDOs must ensure rigorous authentication in a manner promoting ease of use. Digital identity is central to supporting these processes, and enables the enforcement of mobile device security by establishing effective passwords and authentication that is not disruptive to efficient clinician workflows. Accessing confidential information using mobile-based authentication modalities is a key requirement.

Providing new mobile technologies to clinicians enables faster care delivery to patients. An evaluation of how mobile devices affect patient satisfaction found that 96% of organizations that implemented mobile devices observed improved patient satisfaction/experience scores.^[3] Further, 72% of organizations indicated that improved quality of patient care was a direct result of enabling clinician mobility. As HDOs work to streamline clinical workflows by deploying greater mobility, clinicians can spend more time face-to-face with patients and their families, contributing to improved patient experience and satisfaction, and allowing for better quality of care delivery for a higher number of patients each day.

By leveraging available authentication methods on clinicians’ mobile devices, including proximity card, soft tokens, biometric identification and facial recognition, HDOs can support secure, efficient, and easy mobile access. Supporting trusted authentication on mobile devices and applications is now possible thanks to digital identity platforms, which also enable HDOs to establish audit trails documenting which clinician used a particular device at a particular time, at what location and for what duration, thus helping to diminish the loss rate of devices. Reducing barriers to secure access can be achieved through the effective deployment of digital identity and mandatory authentication at the device and application level, enabling HDOs to ensure security in bring your own device (BYOD) and shared-use settings that is frictionless.

Employing existing authentication workflows that are well familiar to clinicians on their mobile devices enhances user experience. For shared environments the challenge centers on achieving a personalized experience without repetitive manual workflows, regardless of what device is in use. For personal devices, HDOs need to enable mobile device access through a trusted, seamless second factor authentication. Secure access to critical tools must be supported for all relevant locations around the clock, while achieving full compliance with Drug Enforcement Agency (DEA) or other regulatory authority regulations for such applications as electronic prescription of controlled substances (EPCS).

Inadequate staffing levels and insufficient time spent with patients often contributes to fatigue and professional burnout. According to a report done by the American Nursing Association, 89% of respondents shared that their organization is experiencing a staffing shortage.^[4] One method to help reduce clinician burnout is to simplify and streamline IT and clinical workflows at the point of care by ensuring increased availability of clinical information and expanded device functionality. Furthermore, clinicians benefit from an expanded ability to share information more quickly, improving communication and coordination across multidisciplinary care team members. Easing and expediting real-time mobile access to confidential patient information while providing care improves clinician efficiency and productivity. Simplifying and expediting clinician management of alarms, administration of medications, and other time-sensitive tasks through mobile device use improves point of care delivery, and enhances clinician experience and satisfaction.

Mobile devices are less expensive to purchase, manage, and maintain than traditional desktop environments.^[5] Standardizing technologies that can be shared between clinicians is cost-effective and requires less effort from IT teams as efficiencies of scale are created managing fewer devices and unique environments. In addition, with distributed mobile device docking stations across hospital units, greater ease of mobile access to the EHR helps maximize its appropriate utilization, and expands value derived from a significant EHR investment.

As the number of smart devices grows, ensuring that connected devices in the healthcare environment are properly secured against potential threats is a daunting task. This complexity is compounded when devices support access to many workflows and more sensitive information, and are shared across different clinical resources. A reported 67% of HDOs recognize that data privacy is a top concern for mobile devices.^[3] Given US Department of Health and Human Services (DHHS) recent advisories around HIPAA compliance for connected devices in healthcare settings,^[6] keeping accurate audit trails of inventory and security measures for mobile devices is more important than ever. HDOs must meet the challenge of tracking which users had access to which devices at a particular time and for what purpose. There is increasing need for comprehensive, end-to-end mobile management solutions that facilitate HDO optimization of their mobile deployment, including delivering automated device provisioning, secure device checkout and secure, rapid user access. Thus, HDOs face a formidable challenge in unlocking the full potential of shared mobile devices because of the imperative to ensure expedited, efficient workflows while simultaneously improving security and auditability.

Security assurance processes can hinder usability and adoption, causing sub-optimal return on HDO investments in mobile tools. Ensuring mobile device security/privacy with minimal impact on clinical workflow efficiency can be challenging in enterprise-owned device and BYOD settings. Supporting security and compliance directly within mobile workflows by leveraging digital identity enables HDOs to reduce friction that negatively impacts usability and diminishes exposure and adoption risk by ensuring secure access to needed information and tools in real-time.

When resources are shared among users, HDOs need to support personalization and privacy in a shared enterprise-owned device environment. Leveraging digital identity to enable trusted access to devices/applications is possible using modalities such as badge-tap device assignment, which lock down shared devices and prevent unauthorized access between users.

To qualitatively describe a use case at Yale New Haven Health System (YNHHS) illustrating the need for and effective deployment of innovative technologies to manage an enterprise-owned shared devices program. Enterprise-owned shared device management provides clinicians with secure, rapid access to enterprise mobile devices and applications, maintains devices in functional, use ready condition for clinicians, and enables enterprise tracking and reduced loss of devices.

Yale New Haven Health (YNHHS) is a large comprehensive healthcare system in Connecticut delivering clinical care services through five hospital facilities and employing over 37,000 individuals, including more than 7,500 university-affiliated and community-based physicians and advanced care practitioners. The study interviews were completed during September 2023 and collated and validated that October. Primary interviews were collected from the management of the health system’s Digital and Technology Solutions team, collated and documented, with review and validation of content by other key members of the technical teams responsible for implementing and supporting the new shared mobile solution. From a device standpoint, YNHHS encompasses over 35,000 workstations and over 10,000 mobile devices (all iOS operating system Apple devices, including iPads as well as iPhones).

Executive leaders in clinical information technology and informatics management at YNHHS were interviewed through written and telephonic communication. Qualitative use case data was gathered from interviews and correspondence with YNHHS clinical information technology executives, managers and staff and representatives of a leading identity and access management (IAM) solutions and EOSD management solution provider. The interview, conducted by teleconference, was comprised of 15 initial questions that were shared in advance, including follow up queries and confirmation of information conveyed, and was recorded. Interview duration was 60 minutes. Interview content was transcribed for validation and documentation purposes.

Use case information was gathered, integrated and shared with the participating health system executives and health IT/informatics leaders to validate the descriptive accuracy of unmet needs, solution objectives and impact/value delivered following implementation of the EOSD solution. Recommended changes in use case content were completed, and a final report was shared with executive and health system IT/informatics stakeholders for final review and approval approximately four weeks after the interviews were conducted. Minor edits based on feedback from the health system were received two weeks later, along with authorization to publish the findings.

Prior to implementing an advanced enterprise-owned shared device solution, YNHHS had a need to systematically and effectively manage a large fleet of shared smartphones across five hospitals. In achieving the latter, a high priority was to simplify IT operations, while both ensuring a positive clinician experience/satisfaction and safeguarding patients’ personal health information (PHI). In 2022, YNHHS initially introduced in excess of 6,000 enterprise iPhones during implementation of a new mobile collaborative clinical communications application at the system’s five Connecticut hospitals. Previously, YNHHS IT services utilized a mobile device management (MDM) platform to enroll, configure and track hospital iOS mobile phones, which was time consuming and manually intensive.

The average HDO in the US experiences an annual mobile device loss rate of 15%-20%.^[7] With a similar device loss rate, YNHHS IT leaders recognized that in the absence of effective monitoring capabilities, the system would be inefficient in tracking and replacing lost iPhones. It needed to ensure that the health system would never face a scenario where there were insufficient devices on hand to satisfy clinician demand for mobile smartphones. In addition, YNHHS IT services sought the ability to lock a mobile phone if not checked back in within a specified time (48 hours beyond the scheduled return time).

A cross-departmental technology evaluation committee, composed of representatives of client services, information technology, mobile solutions, clinical informatics and clinicians, examined available mobile management solutions. The committee compared key technology and functional features, implementation capabilities, and ongoing technical support from solution providers. In particular, a mobile solution needed to have substantial growth capacity and a clear roadmap of how the solution would evolve in the future. YNHHS implemented Imprivata solutions to support a secure, consistent workflow experience across all mobile devices used to access their applications and clinical information. For shared device workflows, Imprivata GroundControl was the EOSD management solution used to automate smartphone provisioning, and to provide a comprehensive access control solution that would streamline mobile device access and authentication. This offered cloud-based management tools to enable easy tracking, support and maintenance of dispersed mobile assets.

GroundControl was integrated with the existing, earlier implemented Imprivata OneSign single sign-on solution, which enabled a rapid, familiar, and consistent authentication process for clinicians on clinical workstations, virtual desktops, and mobile phones. Thus, clinical users would engage the new EOSD management solution using secure access technology and a workflow that they were already well familiar with and actively using. Mobile device access was identical to the process that clinicians used to access the organization’s clinical workstations, the health system EHR, and other clinical applications.

IT administrators could establish user authentication polices across systems and varied workflows from a centralized platform to improve reporting compliance and reduce ownership total cost. IT resources required to administer and manage authentication workflows decreased. Users could access shared mobile devices with a proximity identity badge tap, and quickly access their applications, removing the need for manual authentication, much as they did to the organization’s EHR and other clinical applications.

The Imprivata GroundControl EOSD management solution supported cloud-based device management and could be maintained and updated from any location 24/7/365. YNHHS benefited from personalized device checkout, and ease of application access. For physicians accessing PHI from a BYOD personal device, Imprivata Confirm ID for Remote Access improved security by enabling enterprise-wide two-factor authentication for remote network access, cloud applications and Windows servers and desktops. Imprivata Confirm ID for EPCS provided the broadest range of DEA-compliant two-factor authentication modalities, including hands free authentication (HFA), push token notification, and fingerprint biometrics in order to ensure that EPCS is fast and convenient for providers.

Because YNHHS is a multi-hospital system comprised of various facilities spread across a large geographic service area, implementation planning with the solution provider involved early formal and planned enterprise-wide communications about the EOSD management solution in a timely and consistent manner. IT administrative leaders and staff emphasized that this would reduce potential concerns or resistance to the deployment. In addition, standard user training content on the new mobility solution was conveyed by the solution provider to YNHHS, which its training team integrated and disseminated by both a PowerPoint presentation and a video posted on the system’s internal intranet. This included a profile summary of the applications that would be available on mobile devices as managed by the Imprivata Ground Control solution.

In planning such a major rollout, YNHHS IT/informatics executives reported that the organization recognized, prior to the implementation, that a systematic strategy for shared device management was needed. Having the ability to systematically, rapidly and efficiently provision, maintain, and audit a large number of mobile devices was essential. After evaluating available potential solutions on the market, the GroundControl shared device management solution from Imprivata was selected and implemented across the system to enable effective management of the expanding mobile device fleet. YNHHS leaders reported that this was accomplished successfully, and the EOSD management solution was integrated with the existing MDM solution deployed within the YNHSS IT system. The solution was reported to have improved visibility, security and optimal management of the device fleet.

After implementation, YNHHS IT/informatics leaders reported that the shared mobile management solution made it easier to track check-ins and check-outs of 6,000 enterprise mobile devices, and improved device accountability and reporting mechanics. EOSD management yielded estimated annual recurrent cost avoidance and savings of $500,000 due to reduced device loss, with fewer lost or stolen devices following implementation. This estimate was based on a per device cost of $284, encompassing fractional IT staff time reduced for device loss detection and reporting, replacement and redeployment. These value estimates do not factor in consideration of the lost productivity of the clinical department affected by a device loss, but presumably if it were possible to estimate and quantify this systematically, it would increase the impact and value conveyed by the EOSD management solution. The baseline device loss rate fell from 1,260 to 240 devices, or from 21% to 4% in absolute terms (a relative decrease of 81%). Importantly, these device numbers are not static, and devices were added over the course of and subsequent to EOSD solution implementation. Device loss rate increased during the biannual device refresh. Thus, the estimates conveyed should be regarded as conservative and minimal cost avoidance and savings achieved.

Increased IT/informatics agility was evident in more rapid mobile device setup and deployment. Improved IT team productivity resulted, as informatics team members were able to focus on more strategic tasks and needs. The burden on the IT help desk decreased soon after initial implementation, with fewer mishaps, incoming questions, and problem tickets opened by clinical users. Anecdotally, clinicians reported a superior user experience to their departmental leadership, noting that badge-tap device access was effortless, convenient, and rapid.

YNHHS clinical informatics leaders reported that with the increased automation provided by the EOSD management solution’s functionality, IT productivity and clinician efficiency improved, enabling the organization to maximize the value derived from its investment in mobile technology and its unified communications solution. By automating routine provisioning functions, system IT administrators easily deployed smartphones across all five YNHHS hospitals. System IT/informatics administrators reported more granular visibility and effective control across the mobile device fleet. This greatly simplified management of mobile assets, and an estimated 15%-17% relative reduction in smartphone loss and theft was observed from the prior device loss baseline level of 20% per year (or 75%-85% reduction in absolute terms). In addition, IT administration reported that the EOSD management solution enabled easier real time monitoring of the staff to mobile device ratio across the system.

Loss detection also became a real time rather than periodic assessment. With the new solution, the IT department was able to rapidly contact the last individual that checked out an overdue device, or escalate if needed an inquiry to the departmental manager regarding the status of the device and its expected return. In addition to cost savings from a reduction in mobile device loss rate, cost avoidance and savings to the system were realized by not retaining a particular telephone line in connected/functional status and generating monthly service fees for what in the past was as long as 2-4 months until the device was substantiated and classified as lost. YNHHS estimated that the annual cost savings of replacing lost devices plus reducing the length of time until a line is disconnected was roughly $400,000-$500,000 per annum. In addition, IT staff time receiving, evaluating, and acting upon missing device service tickets decreased substantially. Time spent determining where a reported lost device may be located and seeking approval for and re-ordering a new replacement device from the system’s smartphone carrier also meaningfully decreased, with IT staff able to focus on performing other needed activities and tasks instead.

Clinicians gained instant access to devices, which eliminated workflow friction and increased user satisfaction, with clinicians reporting anecdotally to clinical leaders a superior device use experience, and this drove technology adoption. In addition, IT team members perceived that clinical users of mobile devices had acquired a greater sense of accountability for devices loaned to them following the implementation of the EOSD management solution, and that as a result, had become more conscious of the need to monitor and securely maintain their loaned device.

IT/informatics leaders reported that the solution minimized manual administrative processes, helped simplify IT operations, avoided/reduced problems in provisioning, and reduced the demand for and frequency of IT help desk interactions. The informatics team spent more time focused on strategic concerns supporting the system in key areas and less configuring or tracking potentially lost devices. For example, following implementation iOS updates and other administrative workflows were automated while mobile phones recharged. Asset management tools and status notifications that are cloud-based inform the system IT/informatics team proactively to enable effective monitoring of iPhone health and status data, to track devices, and to minimize inventory loss. The time required for IT team members to contact and engage clinical staff to validate the status of a particular device was reduced substantially.

YNHHS IT/informatics leaders reported that the EOSD management solution enabled the organization to accelerate the amount of time until organizational value was demonstrated. In addition, while not surveyed systematically, improved clinician experience/satisfaction was reported anecdotally to IT leadership and line staff. In particular, the solution helped IT/informatics ensure mobile device availability when clinicians needed one, reducing user frustration that can contribute to clinician dissatisfaction. Leaders noted that the solution not only enabled a consistent user experience with little friction, but also strengthened security by allowing clinicians to access devices rapidly and easily. Clinicians are able to obtain an iPhone with the same identity badge tap already used in workstation single sign-on. This reportedly eased and expedited clinician adoption of the new EOSD management solution. Clinicians’ devices are customized/personalized automatically. IT/informatics leaders were satisfied that devices are wiped clean automatically between uses to prevent inappropriate access to PHI, ensuring HIPAA compliance, information security and confidentiality.

Moving forward, the YNHHS IT/informatics team will further deploy the EOSD management solution to enable single sign-on on mobile devices that are shared and to expand usage of its mobile platform. This will further reduce clinician time spent authenticating into various applications. A near term objective is to include more setup profiles on shared devices so that each particular clinician can access and visualize his or her respective high use applications. This enhanced personalization of mobile devices for clinicians is expected to save more time in accessing key functionality, which is freed up for patient care and other activities. In addition, this will enable multiple frequently used platforms, applications, and tool sets that currently exist only on immobile clinical workstations to be migrated to mobile access. YNHHS is also examining the potential introduction of Android devices into its mobility ecosystem, leveraging its new EOSD management solution.

Future improvements in consistency, ease and speed of navigating IT systems will be sought to minimize clinician frustrations and to increase clinician adoption and satisfaction, and hopefully, contribute to ameliorating staff IT burnout. As the number, nature and complexity of mobile devices increases in future years, the imperative to unify management of access policy and ensure effortless clinician workflows across devices will grow, and YNHHS leaders expect the EOSD management solution to position them well for the challenges ahead.

Finally, IT leaders noted the additive or synergistic value that was conveyed by the EOSD management implementation because it was an integral component of the YNHHS Imprivata identity and access management ecosystem. It was stated that this eased/expedited EOSD solution implementation and clinician adoption, but also promises further synergies and an expansion of what YNHHS regards as not merely a customer services relationship with the provider (Imprivata), but an effective partnership that cuts across multiple areas of critical capabilities, functionality, and platform integration presently, and in the future.