Identity Architecture at Mercy Valley Health
Mercy Valley Health has 22,000 staff, 7,000 affiliated physicians, and 3,000 contractors. Active Directory is on-premises, Okta provides SSO to 80 SaaS apps, but 15 clinical applications still use LDAP and local accounts. MFA is enforced for remote VPN but not for internal EHR access. A phishing campaign compromised one clinician's credentials, and the attacker accessed 200 patient records before detection. HIPAA fines are possible. The CMIO refuses to add MFA to the EHR because it would slow emergency clinicians. There are 300 administrative accounts, 60 of them shared among shift teams. The CISO wants a zero-trust identity program but has no budget for a full replacement of the 15 legacy apps. The board asks for a 6-month plan to prevent a repeat breach.
1. Design an identity architecture that eliminates local accounts and enforces MFA for internal EHR access without breaking clinical workflow.
Read the worked answer
Target a single identity provider with federation, conditional access, and a local-account elimination program.
- Federation: Make Okta (or AD via Okta) the primary IdP for all 80 SaaS apps and the clinical apps that support SAML/OIDC. For the legacy LDAP apps that cannot federate, deploy an identity bridge (LDAP proxy) that authenticates against AD/Okta, not local stores. This removes local accounts over time.
- MFA without workflow pain: Use risk-based conditional access: enforce phishing-resistant MFA (FIDO2) for remote and privileged access; for internal EHR, use smart-card or platform biometrics on managed clinical workstations, with a fast re-authentication window (e.g., 8-hour shift) and shared-workstation badge tap. This avoids repeated prompts that the CMIO fears.
- Privileged accounts: Put the 300 admin accounts in a PAM vault with session recording, just-in-time elevation, and no shared credentials. Rotate secrets after each session.
- Contractors: Federate contractor identities from their home IdP or issue managed identities with time-bound access; no local accounts.
Reasoning: The breach came from a credential compromise. Eliminating local accounts and enforcing MFA at the EHR reduces the attack surface without forcing clinicians to type codes every few minutes.
2. Propose a privileged access management approach for the 300 administrative accounts and 60 shared accounts.
Read the worked answer
Treat the 300 admin accounts and 60 shared accounts as a tier-0 control problem.
- Inventory and eliminate shared accounts: For each shared account, identify the business need. Replace with named accounts plus role-based access; where a shared clinical/workstation account is unavoidable, use a checkout workflow from a vault with automatic rotation.
- Vault all privileged credentials: Use a PAM tool to store, rotate, and broker access. Admin sessions go through a jump host with session recording and keystroke logging. Require MFA plus approval for elevation.
- Just-in-time (JIT) access: Grant admin rights for a defined window (e.g., 2 hours) with a ticket reference. Remove standing admin rights.
- Monitor and alert: Detect anomalous admin behavior (off-hours, mass data access) and integrate with SIEM.
Reasoning: Shared admin accounts destroy accountability. A PAM vault plus JIT reduces standing privilege and gives the hospital an audit trail for HIPAA.
3. How should Mercy Valley manage contractor lifecycle and third-party risk to prevent orphaned access?
Read the worked answer
Use a joiner-mover-leaver process with automated provisioning and third-party attestation.
- Pre-boarding: Contractor identity is sponsored by a hospital manager; access is scoped to the engagement and time-bound. Require background check and HIPAA training before provisioning.
- Provisioning: Federate or create a managed identity; no shared accounts. Use role mining to assign the minimum app entitlements.
- Monitoring: Quarterly access reviews for contractors (more frequent than employees), with manager attestation. Automatically flag dormant accounts at 30 days.
- Termination: Automated deprovisioning within 24 hours; SLA with the staffing agency. For BYOD, require MDM and conditional access.
- Third-party risk: Include the agency in vendor risk management; require breach notification terms.
Reasoning: Contractors are a high-risk population because they leave and change roles frequently. Automation and short review cycles close the orphan-account gap.